# DF-3528 VERDICT

**status: build_failed (module cannot be built on this kernel) — finding is
source-certain and LATENT; leak mechanism proven generically in-guest by
DF-3523 on the same ng_base.c code path.**

## Did it reproduce on the guest?

No — and it cannot, on any DragonFly kernel built from this tree. The PoC
setup (compile `sys/netgraph7/ng_car.c` as a KLD) fails with 68 errors
(build.log, `-Werror`), because the file was never ported from FreeBSD:

- `struct bintime` unknown (ng_car.c:62, 588)
- `getbinuptime()` implicit (ng_car.c:210, 225, 592)
- `bintime_sub()` implicit (ng_car.c:596)
- `struct mtx` / `mtx_init` / `mtx_destroy` / `mtx_lock` / `mtx_unlock`
  unknown (ng_car.c:70-71, 214, 229, 541-542, 722, 765)

`rg getbinuptime sys/` (host, whole tree) matches ONLY ng_car.c; no kernel
config enables `netgraph7_car` (sys/conf/files:1696 `optional`, nothing in
sys/config/). This confirms and matches the pass-1 DF-0622 record ("Dead
code... doesn't compile") and retroactively explains why DF-0623 was
source-only.

## Why the finding is still certain

1. ng_car.c:656-660 arms the timer via `ng_callout()` — the item-carrying
   API (ng_base.c:3248-3269): fresh ng_item + NG_NODE_REF + NG_HOOK_REF per
   arm. Certain by inspection.
2. ng_car.c:539-540 is the ONLY cancel (`ng_uncallout`, ng_base.c:3273-3296).
   Its cleanup branch (ng_base.c:3284-3292) is (a) unreachable on the stock
   kernel because of the DF-3515 callout_stop contract violation, and (b)
   a leak even when reached because netgraph7's `NG_FREE_ITEM` is flag-only
   (netgraph.h:787-792). Both layers were measured in-guest by DF-3523
   (ng_pptpgre, same ng_base functions): 30k arm/cancel cycles → 5.76K
   allocs/830 KB never returned; fixed kernel + fixed ng_base → flat.
3. ng_car's disconnect (ng_car.c:553-580) never cancels the timer at all —
   known DF-0622 — so an armed SHAPE timer at node destruction is the normal
   case, and shutdown's ng_uncallout then cancels-and-leaks it.

Rearm-vs-arm leak (lead (a)): not reachable via ng_car — q_event is a
NGQF_WRITER item serialized against rcvdata readers (ng_base.c:1993-1999),
so `ng_car_schedule()` only ever re-arms an idle callout; the orphaned
`oitem` dead-store (ng_base.c:3266) stays dead for this caller.

## Impact ceiling

Low: the trigger is entirely control-plane (root: mkpeer/setconf/rmhook);
the unprivileged-data-driven variant is DF-3523's (ng_pptpgre), already
filed. Latent until the module is ported. If ported unchanged, each node
destruction with an armed SHAPE timer permanently leaks ≤2 ng_items + node
refs + hook refs (objcache exhaustion → DF-3474-style M_WAITOK wedge;
name-registration pinning; DF-3514-style idhash growth).

## Fix validation

Not performed here (nothing to validate against — module cannot build).
The code fix is the already-validated DF-3523 pair (kern_timeout contract +
ng_free_item in ng_uncallout); fix.diff in this pack carries the ng_base
layer plus the rearm-oitem free for completeness.

## Bottom line

Real refcount-lifetime defect in dead code: file it, fix ng_base (DF-3523
fix covers it), and either port ng_car to DragonFly primitives or delete it.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.