# DF-3538 VERDICT — reproduced (kernel heap info leak, ng7 twin of DF-3537)

## Bottom line

**Reproduced** on the same guest (DragonFly 6.5-DEVELOPMENT #0, stock
INVARIANTS kernel) with the netgraph7 stack built from `/usr/src/sys/netgraph7`
(core + socket + vjc modules) and loaded on a fresh boot (ng7 and v1 sockets
both claim AF_NETGRAPH). The ng7 vjcomp path
(`sys/netgraph7/vjc/ng_vjc.c:449-463`) is line-identical in logic to the v1
path and shares the engine (`sys/net/ppp_layer/slcompress.c` — the ng7
module's Makefile `.PATH`s into `net/ppp_layer` and compiles it), so the
2-byte-probe oracle behaves identically: **30/30 rounds** wrote stale mbuf
bytes (`0x1111`, residue of the preceding sync frame's TCP window field,
which was never part of the 2-byte probe) into `rstate[1].cs_ip.th_sum`,
read back with `NGM_VJC_GET_STATE` (mirror verified by a legal 19-byte
frame, `th_sum=0xC75D`). Impact: **kernel memory info leak** (stale mbuf
data / cross-packet disclosure); no write crosses an object boundary.

## Root cause (path:line)

- `sys/netgraph7/vjc/ng_vjc.c:449-454` — pullup only
  `min(MAX_VJHEADER, m_pkthdr.len)` bytes;
- `sys/net/ppp_layer/slcompress.c:524` — mandatory checksum read with no
  length validation;
- `sys/net/ppp_layer/slcompress.c:115-140` — DECODE* macros read 1–3 bytes
  each unchecked;
- `sys/net/ppp_layer/slcompress.c:571-575` — only post-hoc length check.

## Fix validation

`fix.diff` (bounds-checked reads in the shared engine) applied to the
guest's `/usr/src`; ng7 `ng_vjc.ko` rebuilt (it embeds `slcompress.c`) and
reloaded; identical PoC re-run: oracle **0/30** leaks, `[sanity]
th_sum = 0xC75D OK` (no functional regression). Baseline vs patched logs:
`run.log` (30/30) and `fix_run.log` (0/30).

## Threat model

Same as DF-3537: the remote peer of a VJ-compressed link whose ng7 vjc node
decompresses peer frames (e.g. ng7-based PPP). Local graph construction
needs root; the PoC is a demonstration vehicle. Leak-only → Medium.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.