{
  "finding_id": "DF-3550",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "none",
  "confidence": "certain",
  "verdict": "Reproduced live on the stock v1 netgraph stack: a frame written into sample:downstream is reflected straight back to the sender (readable again on the sending data socket) and GET_STATUS reports packets_in=0/packets_out=1, because downstream_hook.dlci stays 0 (constructor M_ZERO at sys/netgraph/ng_sample.c:155 initializes only the 16 DLCI channels at :158-161; the newhook downstream branch at :233-237 never sets the documented -1 sentinel from :118) so rcvdataqs dlci != -1 branch at :355 forwards the frame back out downstream_hook.hook at :362-364; the intended decode/demux branch (:365-375) is unreachable. Module builds from /usr/src (-Werror, RC=0) but does not ship (no sys/netgraph/Makefile SUBDIR entry, no sys/conf/files line, absent from /boot/kernel); node creation is root-gated (caps_priv_check at sys/netgraph/socket/ng_socket.c:172). v1 twin of DF-3545 (ng7), demonstrated live for the first time. DF-0690s v1 counterpart and the newhook defects are filed separately (DF-3551, DF-3552).",
  "exploit_chain": "",
  "evidence": "run.log (RECEIVED 4 bytes back: PING / RESULT: REFLECTED / GET_STATUS: packets_in=0 packets_out=1), v1demo.c (v1-ABI AF_NETGRAPH driver), build.log (module -Werror RC=0), fix.diff (one-line sentinel init)",
  "kernel_refs": [
    "sys/netgraph/ng_sample.c:118",
    "sys/netgraph/ng_sample.c:155",
    "sys/netgraph/ng_sample.c:158",
    "sys/netgraph/ng_sample.c:233",
    "sys/netgraph/ng_sample.c:355",
    "sys/netgraph/ng_sample.c:362",
    "sys/netgraph/ng_sample.c:365"
  ],
  "poc_changes": "Demo written from scratch for the v1 ABI: NG_VERSION 2, 52-byte ng_mesg header (u16 arglen at offset 4), NGM_GENERIC_COOKIE 851672668, data socket associated to the control sockets node via NGM_NODEINFO + connect(\"[id]:\") exactly like libnetgraph NgMkSockNode; generic cmds (MKPEER/CONNECT) return errors synchronously from sendto(2) and send no response.",
  "attempts": 4,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 1800,
  "guest_dirty": 0,
  "build_cmd": "make -C /root/ngs1 KMOD=ng_sample (see build.sh); cc -O2 -Wall -o /root/v1demo /root/v1demo.c",
  "run_cmd": "kldload ng_socket; kldload /root/ngs1/ng_sample.ko; /root/v1demo reflect",
  "code_hash": "1517851c923420332e62c40c89ead87fbaeb6967e76d529de564364011b5e929",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "One-line sentinel fix (downstream_hook.dlci = -1 in the newhook downstream branch, fix.diff, git-apply --check clean); kernel rebuild validation skipped per contract for Info-severity findings (mirrors DF-3545).",
  "fix_evidence": "fix.diff",
  "notes": "Also verified live in the same session: the module builds from /usr/src and loads on the stock v1 stack (harness fact confirmed); ngctl/nghook are v1-ABI and could have driven this, but a raw socket demo keeps the evidence self-contained.",
  "recommended_fix": "Set xxxp->downstream_hook.dlci = -1 when accepting the downstream hook in ng_xxx_newhook (ng_sample.c:234)."
}