# DF-3550 — VERDICT: REPRODUCED (v1 twin of DF-3545)

**Impact:** none (misroute/reflection in a dormant template node) **Confidence:** certain

## What was run

`v1demo reflect` on the stock v1 netgraph stack (guest boots `netgraph.ko`
v1; `ng_socket.ko` + freshly built `ng_sample.ko` loaded as root). The demo
speaks the v1 ABI natively (NG_VERSION 2, 52-byte `struct ng_mesg` header,
`NGM_NODEINFO` + `connect("[id]:")` data-socket association exactly like
libnetgraph's `NgMkSockNode`), builds the graph
`socket(sd) <-> sample(downstream)` via `NGM_MKPEER`, writes `"PING"` out
`sd`, and polls the data socket for a reply.

## Observed (run.log)

```
RECEIVED 4 bytes back: 'PING'
RESULT: REFLECTED
GET_STATUS: packets_in=0 packets_out=1
```

The frame written into `sample:downstream` came straight back out the same
hook, and `NGM_XXX_GET_STATUS` reports `packets_out=1 / packets_in=0` — the
demux branch never ran.

## Why (kernel path, line-by-line)

1. `ng_xxx_constructor()` `M_ZERO`s the whole `struct XXX`
   (sys/netgraph/ng_sample.c:155) and then initializes only the 16 DLCI
   channels (`:158-161`). `downstream_hook.dlci` stays **0**.
2. `ng_xxx_newhook()`'s downstream branch (`:233-237`) stores the hook
   pointer and private pointer but never sets the `-1` sentinel documented
   at `:118` (`int dlci; /* -1 == downstream */`).
3. Data arriving on the downstream hook: `ng_xxx_rcvdata()` reads
   `dlci = hookinfo->dlci == 0` (`:333`), `ng_xxx_rcvdataq()` takes the
   `dlci != -1` "received on a DLCI hook" branch (`:355`) and forwards the
   frame back out `xxxp->downstream_hook.hook` (`:362-364`) — the very hook
   it arrived on → reflection to the sender, `packets_out++`.
4. The intended decode branch (`:365-375`) is unreachable dead code.

Module state: `ng_sample.ko` **builds from /usr/src** (`-Werror`, RC=0,
build.log) but **does not ship** (no SUBDIR entry in `sys/netgraph/Makefile`,
no `sys/conf/files` line, absent from `/boot/kernel`). Instantiating a
`sample` node requires root (v1 control sockets are `caps_priv_check`
gated, sys/netgraph/socket/ng_socket.c:172) plus an explicit kldload.

## Exploit chain

None — dormant template, misroute/reflection only, no memory-safety impact.
(An administrator who wires `sample:downstream` to a real interface hook
would create a packet-reflection loop, but that already requires root.)

## Fix validation

`fix.diff` adds the one-line sentinel (`xxxp->downstream_hook.dlci = -1;` in
the newhook downstream branch). Kernel-rebuild validation skipped per
contract for Info-severity findings (mirrors DF-3545's treatment of the
ng7 twin); the patch is a trivially auditable initialization fix.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.