# DF-3550 evidence pack — v1 ng_sample downstream reflection (DF-3545 twin)

`sys/netgraph/ng_sample.c` (v1 netgraph template, node type "sample"):
`downstream_hook.dlci` is never initialized to the `-1` sentinel — the
constructor `M_ZERO`s the whole private struct (`ng_sample.c:155`) and only
the 16 DLCI channels get explicit values (`:158-161`), while
`ng_xxx_newhook()`'s downstream branch (`:233-237`) stores the hook pointer
but never sets `dlci = -1`. Data arriving on `sample:downstream` therefore
has `dlci == 0`, takes the `dlci != -1` "from a DLCI channel" branch in
`ng_xxx_rcvdataq()` (`:355`) and is forwarded straight back out
`downstream_hook.hook` (`:362-364`) — i.e. **reflected to the sender** —
while the intended decode/demux branch (`:365-375`) is dead code.

This is the v1 twin of DF-3545 (ng7 `ng_sample`), verified live here for the
first time against the stock v1 netgraph stack.

## Build

See `build.sh` — builds `ng_sample.klo` from `/usr/src/sys/netgraph` and
compiles `v1demo`. Module build log: `build.log` (RC=0, `-Werror`).

## Run

See `run.sh` — loads `ng_socket.ko` + `ng_sample.ko`, then `v1demo reflect`.

## Expected

```
RECEIVED 4 bytes back: 'PING'
RESULT: REFLECTED
GET_STATUS: packets_in=0 packets_out=1
```

`packets_in=0 / packets_out=1` proves the frame was misclassified as DLCI
egress traffic (dead decode branch) instead of counted as demux input.

## Contents

- `v1demo.c`            v1-ABI driver (raw AF_NETGRAPH sockets; NG_VERSION 2,
                        52-byte ng_mesg header, libnetgraph-style data-socket
                        association via NGM_NODEINFO + `connect("[id]:")`)
- `build.log`           module build (-Werror, RC=0)
- `run.log`             decisive run (reflection + leak + hooktest sections)
- `env.txt`             guest uname / compiler / module state
- `fix.diff`            one-line sentinel fix