{
  "finding_id": "DF-3529",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Speculative, root-gated use-after-free race: ng_ethers data-path callbacks run under the BGL (if_ethersubr.c:393/1175) but the NGM_ETHER_DETACH teardown (ng_ether.c:313-328 -> ng_ether_shutdown REALLY_DIE kfree(priv) ng_ether.c:684-686) runs from the netgraph item dispatcher with no BGL and no shared lock, so a control-message detach can free struct private while another CPU is between its NG_NODE_PRIVATE(node) load and its uses in ng_ether_output/input (ng_ether.c:219/255/596/640); the codes own comment flags it (ng_ether.c:326 XXX race if interrupted an output packet). Not demonstrated: reaching NGM_ETHER_DETACH needs a control socket gated by caps_priv_check(SYSCAP_RESTRICTEDROOT) (ng_socket.c:182), and the window is a single load-to-use span; no fuzzing campaign was run for this Low item.",
  "exploit_chain": "",
  "evidence": "VERDICT.md + README.md: locking asymmetry citations (if_ethersubr.c:393,1175 get_mplock vs ng_apply_item no-BGL), teardown free path ng_ether.c:684-686",
  "kernel_refs": [
    "sys/netgraph7/ether/ng_ether.c:313",
    "sys/netgraph7/ether/ng_ether.c:326",
    "sys/netgraph7/ether/ng_ether.c:684",
    "sys/net/if_ethersubr.c:393",
    "sys/netgraph7/socket/ng_socket.c:182"
  ],
  "poc_changes": "n/a (no PoC authored)",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a",
  "code_hash": "",
  "notes": "Filed as hardening: the pattern becomes interesting only if the netgraph control plane is ever exposed below root. Guest left untouched this pass (analysis-only; guest only used for DF-3528 build attempt in /tmp).",
  "recommended_fix": "Take the BGL (or a private-data rwlock/reference) across ng_ether_detachs IFP2NG/priv->ifp invalidations and ng_rmnode_self, making teardown symmetric with the data path."
}