{
  "finding_id": "DF-3511",
  "verdict": "reproduced",
  "impact": "dos",
  "confidence": "certain",
  "reproduce": {
    "build": "in guest as root: sh /root/df3511/build.sh   (builds netgraph7 netgraph.ko + ng_socket.ko from /usr/src/sys/netgraph7, then cc -O2 -Wall -o /root/df3511/trigger /root/df3511/trigger.c)",
    "run": "sh /root/df3511/run.sh   (kldload /root/ng7/netgraph.ko + ng_socket.ko; /root/df3511/trigger loaded 50000 (control); /root/df3511/trigger bogus 50000 (leak)); memory via sysctl vm.stats.vm.v_free_count + netstat -m",
    "expected": "UNFIXED: phase A (type \"socket\"): 50000x errno 22 EINVAL, memory flat, mbufs flat. Phase B (type \"df3511x\", not loaded): 50000x errno 6 ENXIO, ~0.17 page (~683B) leaked per send (8372 pages / 33.5MB over 50k), netstat -m mbufs-in-use grows by EXACTLY +1 per send (12 -> 50012). FIXED (fix.diff): same ENXIO/EINVAL behavior, memory flat, mbufs 7 -> 7."
  },
  "kernel_refs": [
    "sys/netgraph7/socket/ng_socket.c:285",
    "sys/netgraph7/socket/ng_socket.c:287",
    "sys/netgraph7/socket/ng_socket.c:261",
    "sys/netgraph7/socket/ng_socket.c:246",
    "sys/netgraph7/socket/ng_socket.c:344",
    "sys/netgraph7/socket/ng_socket.c:351",
    "sys/netgraph7/socket/ng_socket.c:1175"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "trigger.c",
    "diag.c",
    "build.sh",
    "run.sh",
    "build.log",
    "run.log",
    "fix_run.log",
    "env.txt",
    "fix.diff",
    "manifest.json",
    "verdict.json"
  ],
  "notes": "Root-gated (control socket is SYSCAP_RESTRICTEDROOT). Side-discovery: linker_api_available()==0 on every send (pru_send handlers run on a protocol thread, curproc==NULL), so module autoload via AF_NETGRAPH MKPEER is functionally always-ENXIO on this kernel. Stock userland ng_message.h does NOT match netgraph7 layout - trigger must hand-roll the 56-byte ng7 header (see VERDICT.md)."
}