# DF-3516 VERDICT — REPRODUCED (panic), fix validated

## Reproduced? YES — deterministic kernel panic, 4 syscalls, no race.

Guest: DragonFly 6.5-DEVELOPMENT #0 (X86_64_GENERIC, stock INVARIANTS kernel),
netgraph.ko + ng_socket.ko from /boot/kernel. PoC run as root.

## The chain, line by line

1. `socket(AF_NETGRAPH, SOCK_DGRAM, NG_CONTROL=2)` → `ngc_attach`
   (sys/netgraph/socket/ng_socket.c:165-182). Root-gated at :172
   (`caps_priv_check(SYSCAP_RESTRICTEDROOT|__SYSCAP_NULLCRED)`) →
   `ng_attach_cntl` (:476-503): creates pcb + ngsock, `pcbp->sockdata = privdata`,
   `sockdata->refs = 1`.
2. `bind(s, {"shutme"})` → `ngc_bind` → `ng_bind` (:709-723): names the node.
3. `sendto(s, NGM_SHUTDOWN, ..., "shutme:")` → `ngc_send` (:201-273):
   `pcbp->sockdata->node` (:257) is still valid here; `ng_send_msg`
   (sys/netgraph/netgraph/ng_base.c:1208-1233) resolves the path and runs
   `ng_generic_msg` → `case NGM_SHUTDOWN: ng_rmnode(here)` (ng_base.c:1256-1258).
   `ng_rmnode` (:425-449) sets `NG_INVALID` and calls the type shutdown
   `ngs_rmnode` (ng_socket.c:910-935):
   - `dpcbp`/`pcbp` non-NULL → `soisdisconnected(pcbp->ng_socket)`,
     `pcbp->sockdata = NULL`, `sockdata->refs--`
   - `node->private = NULL`, `ng_unref(node)`, `kfree(sockdata)`
   — the control socket **stays open** with `so_pcb = pcbp` (nothing clears it;
   only `ngc_detach` does). sendto returns 52 (bytes sent).
4. `connect(s, {"shutme:link0"})` → `soconnect` (sys/kern/uipc_socket.c:685-713):
   no `SS_ISCONNECTED`/`SS_ISDISCONNECTED` rejection for PR_ATOMIC|PR_ADDR sockets
   → `so_pru_connect` → `ngc_connect` (:291-303) → `ng_connect_cntl`
   (:680-703): `sockdata = pcbp->sockdata` == NULL; `ng_path_parse("shutme:link0")`
   returns node+hook (both non-NULL, so the :690 guard passes); :694
   `ng_findname(sockdata->node, node)` evaluates `sockdata->node` —
   `struct ngsock.node` is the first member (offset 0) → **read of vaddr 0x0**.

Observed (dfbsd-qemu/boot.log, captured in panic.txt / run.log):

```
Fatal trap 12: page fault while in kernel mode
fault virtual address    = 0x0
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff8263e9d2
Stopped at      ngc_connect+0x52:       movq    (%r13),%rdi
```

`movq (%r13),%rdi` is exactly the load of `sockdata->node` (r13 = NULL sockdata)
whose result feeds `ng_findname`'s first argument. Guest died; ssh hung; vm status
"down" right after. Classification: reproduced / impact=panic.

## Why not uid0?
NULL-deref read at a fixed offset 0 — a denial-of-service primitive, not a
write. No escalation path.

## PoC corrections vs the seed I wrote myself
- NG_CONTROL is 2 on DragonFly (guessed 1) — use
  `<netgraph/socket/ng_socket.h>`.
- Step 2 originally a second `sendto` — blocked: `soisdisconnected()` makes
  `sosend` fail EPIPE/SIGPIPE *before* `ngc_send` runs (observed EXIT=141).
  `connect()` is the route: `soconnect` has no disconnected-state gate.
- Connect address must be `node:hook` (both parts) or `ng_path_parse` returns
  hook==NULL → early EINVAL (:690) before the deref. `shutme:link0` works.

## Fix validation — FIXED (module-level)
fix.diff adds the missing NULL checks (mirroring ngd_send:357/ng_bind:714):
- `ngc_send`: `if (pcbp->sockdata == NULL) { error = ENOTCONN; goto release; }`
- `ng_connect_cntl`: `if (sockdata == NULL) { TRAP_ERROR; return (ENOTCONN); }`

Applied in guest /usr/src (repo sys/ untouched), module rebuilt
(`sys/netgraph/socket` make), loaded over stock. Same PoC:
`connect returned -1 errno=57 (ENOTCONN)`, no panic, guest alive, and the
NGM_SHUTDOWN good-path send still works (returns 52) — no regression.

## Kernel refs
- sys/netgraph/socket/ng_socket.c:257 (ngc_send bare deref)
- sys/netgraph/socket/ng_socket.c:694,701 (ng_connect_cntl bare deref)
- sys/netgraph/socket/ng_socket.c:910-935 (ngs_rmnode NULLs sockdata, frees ngsock,
  leaves so_pcb set; soisdisconnected)
- sys/netgraph/socket/ng_socket.c:357,714,444 (the three sibling paths that DO check)
- sys/netgraph/netgraph/ng_base.c:1256-1258 (NGM_SHUTDOWN → ng_rmnode)
- sys/kern/uipc_socket.c:685-713 (soconnect — no SS_ISDISCONNECTED gate)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.