{
  "finding_id": "DF-3538",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "leak",
  "confidence": "certain",
  "verdict": "Reproduced with the netgraph7 stack (core+socket+vjc modules built from /usr/src/sys/netgraph7, loaded on a fresh boot since ng7 and v1 sockets both claim AF_NETGRAPH): the ng7 vjcomp path (ng7 ng_vjc.c:449-463) shares the v1 logic and the shared slcompress engine, and the 2-byte-probe oracle leaked stale mbuf bytes into rstate[1].cs_ip.th_sum in 30/30 rounds (0x1111 = prior sync frames window field), with the struct mirror verified by a legal 19-byte frame (th_sum=0xC75D). Leak-only. fix.diff bounds-checks the engine reads; ng7 ng_vjc.ko rebuilt with it: 30/30 -> 0/30, sanity intact.",
  "exploit_chain": "remote/local frame source -> short vjcomp frame -> sl_uncompress_tcp_core reads past m_len (checksum read + DECODE walk, no buflen checks) -> stale bytes persist in rstate[cid].cs_ip -> next clean compressed frame emits them inside the reconstructed TCP/IP header to the ip hook",
  "evidence": "run.log: [oracle] 30/30 rounds leaked non-zero stale bytes via th_sum + [sanity] th_sum = 0xC75D OK; fix_run.log: 0/30 after fix.diff with sanity still OK",
  "kernel_refs": [
    "sys/netgraph7/vjc/ng_vjc.c:449",
    "sys/netgraph7/vjc/ng_vjc.c:454",
    "sys/netgraph7/vjc/ng_vjc.c:461",
    "sys/net/ppp_layer/slcompress.c:115",
    "sys/net/ppp_layer/slcompress.c:524",
    "sys/net/ppp_layer/slcompress.c:571"
  ],
  "poc_changes": "Built libnetgraph7 from /usr/src/lib/libnetgraph7 sources directly into the PoC binary (no installed ng7 userland exists); ng7 modules built from /usr/src/sys/netgraph7 and loaded on a fresh boot (AF_NETGRAPH conflict with v1).",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 900,
  "guest_dirty": 0,
  "build_cmd": "cc -O -DUSE_NG7 -I/usr/src/lib/libnetgraph7 -I/usr/src/sys -o /root/vjc_oob_leak7 /root/vjc_oob_leak7.c /usr/src/lib/libnetgraph7/sock.c /usr/src/lib/libnetgraph7/msg.c /usr/src/lib/libnetgraph7/debug.c",
  "run_cmd": "kldload <ng7 modules> && /root/vjc_oob_leak7",
  "code_hash": "855b59d625de86b3d45bb091ed74209769674b230fbaae3f390dcf53597fc217",
  "notes": "ng7 twin of DF-3537; same engine fix validates both. v1 netgraph core module is not unloadable (MOD_UNLOAD -> EBUSY), hence the fresh-boot procedure.",
  "recommended_fix": "Bounds-check every read in sl_uncompress_tcp_core against buf+buflen (DECODE macros, changes/CID/checksum, struct ip minimum) and fail the frame via the existing bad path; see fix.diff.",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied to /usr/src/sys/net/ppp_layer/slcompress.c; ng7 ng_vjc.ko rebuilt (module embeds slcompress.c) and reloaded; identical PoC: 30/30 -> 0/30 oracle leaks with the legal-frame sanity check still passing.",
  "fix_evidence": "fix_run.log (0/30 + sanity OK), fix_build.log (module relink), compare run.log (30/30)"
}