{
  "finding_id": "DF-3520",
  "status": "not_reproduced",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "NOT REPRODUCED in-kernel on this guest, arithmetic certain: once the xmitSeq-recvAck window invariant breaks past 17 via the DF-0596 TOCTOU family (racy window check ng_pptpgre.c:490-495), one ordinary well-formed ack produces index=16 at :641 and the window-shift bcopy at :668 receives length sizeof(pptptime_t)*(16-17) = (size_t)0xFFFFFFFFFFFFFFF8 - an unbounded kernel OOB read+write and certain fatal page fault, far beyond DF-0596s recorded 8-byte OOB write impact ceiling. The userspace bcopy_demo reproduces the exact kernel length computation in-guest (run.log). In-kernel manifestation inherits DF-0596s reachability: SMP-only, blocked from userspace ng_socket by CPU-0 netisr serialization, open in the ng_ether/SMP deployment where the peer needs only a valid cid.",
  "exploit_chain": "",
  "evidence": "run.log (bcopy_demo: index=16, int length=-1, size_t len=0xfffffffffffffff8); VERDICT.md full derivation incl. why the recv-side alone cannot exceed index 15 and why the sink is distinct from DF-0596s :514 write",
  "kernel_refs": [
    "sys/netgraph/pptpgre/ng_pptpgre.c:490",
    "sys/netgraph/pptpgre/ng_pptpgre.c:641",
    "sys/netgraph/pptpgre/ng_pptpgre.c:646",
    "sys/netgraph/pptpgre/ng_pptpgre.c:655",
    "sys/netgraph/pptpgre/ng_pptpgre.c:668"
  ],
  "poc_changes": "Authored from scratch; the userspace --bcopy attempt intentionally does not fault under glibc (memcpy end-pointer wraps mod 2^64) - the deliverable is the length computation itself, identical in kernel and userspace; wording kept honest in README/VERDICT.",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 10,
  "guest_dirty": 0,
  "build_cmd": "cc -O2 -o bcopy_demo bcopy_demo.c",
  "run_cmd": "./bcopy_demo",
  "code_hash": "46b0b4bf36852c76f79c997bd4a78a9e25cbd55728832970069eb59d4a710972",
  "notes": "Impact-amplification finding: corrects DF-0596s limited, ~200 bytes ceiling - with index>=16 the copy length is effectively infinite; one ack packet converts the DF-0596 primitive into a guaranteed panic.",
  "recommended_fix": "Bounds-check index against PPTP_XMIT_WIN before use at :641-:668 (goto badAck) plus the per-node serialization fix so the invariant cannot break.",
  "fix_status": "not_testable"
}