{
  "finding_id": "DF-3518",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "NOT REPRODUCED on this guest, code-certain: ng_pptpgre_rmnode() kfree(priv) (ng_pptpgre.c:437-440) can overlap in-flight rcvdata/rcvmsg because v1 ng_send_data dispatches inline with no peer-node reference or lock (ng_base.c:1687), giving a write-after-free on the ~208-byte priv chunk on SMP. The userspace trigger vector is blocked by the same CPU-0 netisr serialization DF-0590 established empirically (uipc_socket.c:254-259: every ng_socket data AND control send processes on netisr_cpuport(0)); the hammer ran 52k create/config/shutdown lifecycles overlapped with in-flight frames with zero panics and a clean exit, consistent with full serialization. The window is genuinely open in the ng_ether/ksocket per-flow SMP deployment (VPN concentrator). Same code-level certainty class as DF-0590s verified negative.",
  "exploit_chain": "",
  "evidence": "run.log (uaf_hammer 30s: kill_cycles=51962, kill_fail=0, guest up, EXIT_OK, netgraph Count unchanged); VERDICT.md path:line trace of the inline-dispatch-without-ref and the rmnode free",
  "kernel_refs": [
    "sys/netgraph/netgraph/ng_base.c:1678",
    "sys/netgraph/netgraph/ng_base.c:1687",
    "sys/netgraph/pptpgre/ng_pptpgre.c:429",
    "sys/netgraph/pptpgre/ng_pptpgre.c:437",
    "sys/netgraph/pptpgre/ng_pptpgre.c:576"
  ],
  "poc_changes": "Authored from scratch. Fixed during bring-up: killer must not reuse the victims ctl-node hook names or node names (EEXIST/EADDRINUSE storm); unnamed nodes addressed by hook-walk paths (p0); separate ctl nodes for victim vs killer.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -lpthread -o uaf_hammer uaf_hammer.c",
  "run_cmd": "./uaf_hammer 30",
  "code_hash": "055c6e75444ef69238a5954451ae4d64fb2d445acf6e7e04059b73dcbf3f98dd",
  "notes": "Negative result has weight: vector blocker empirically established twice (DF-0590: 1-3M frames; here: 52k rmnode cycles). Expected manifestation on a per-flow SMP data path: fatal fault / heap corruption in ng_pptpgre_xmit/recv after priv free.",
  "recommended_fix": "Serialize v1 ng_pptpgre with a per-node lockmgr lock across rcvdata/rcvmsg/shutdown (as recommended for DF-0590), or hold a node reference plus validity flag across the inline dispatch in ng_send_data.",
  "fix_status": "not_testable"
}