# DF-3545 — ng_sample (ng7) downstream hook misclassified as DLCI 0

## Verdict: REPRODUCED (functional misroute/reflection; no memory-safety impact)

`struct XXX_hookinfo downstream_hook` is zeroed by the constructor's
`M_ZERO` kmalloc (`sys/netgraph7/ng_sample.c:158-165`) and
`ng_xxx_newhook` never sets `downstream_hook.dlci = -1`
(`ng_sample.c:232-236`), although both the struct comment
(`ng_sample.c:125: "-1 == downstream"`) and the data-path dispatch
(`ng_sample.c:341: if (dlci != -1)`) require exactly that.  Every packet
arriving on the **downstream** hook therefore takes the *DLCI-egress*
branch:

```c
if (dlci != -1) {          /* 0 != -1 -> TRUE for downstream */
        NG_FWD_NEW_DATA(error, item, xxxp->downstream_hook.hook, m);
        xxxp->packets_out++;
```

(`ng_sample.c:341-350`) and is **reflected straight back out the same
hook it arrived on**, instead of running the intended decode/demux
branch (`:351-376`), which is unreachable dead code.  Counters are also
wrong (`packets_out` instead of `packets_in`).

Live confirmation on the guest (ng7 base + ng_socket + ng_sample
modules built from `/usr/src/sys/netgraph7` and loaded):

```
RESULT: REFLECTED - received 64 bytes back: 'PING\n'
GET_STATUS: packets_in=0 packets_out=1
```

`sampledemo.c` connects a data socket to `sample:downstream`, writes
`PING`, and reads the same frame back on the *same* socket
(`run.log`).

Impact ceiling: none beyond misrouting/reflection inside a graph an
administrator explicitly built with this node.  `ng_sample` is the
netgraph template ("sample"/xxx node type): it **builds** (RC=0,
`module-build.log`) and **loads**, but it does **not ship** — it is in
no `SUBDIR` of `sys/netgraph7/Makefile`, has no `sys/conf/files`
entry, and `/boot/kernel` contains no `ng_sample.ko`.  Known finding
DF-0690 (debug-hook mbuf+item leak) covers the other dormant-template
defect in this file and is not re-reported here.

## Fix

Set the sentinel in `newhook` (`fix.diff`).  (Optionally also clear
`xxxp->debughook` on debug-hook disconnect — noted in the audit as a
latent-but-unused dangling pointer; `debughook` is never read, so it is
recorded as a negative note rather than a finding.)

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.