{
  "finding_id": "DF-3553",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "ng7 ng_tee admits a pure-topology forwarding cycle: two tees cross-wired T1.left<->T2.left / T1.right<->T2.right, entered via T1.left2right (the entry edge a bare ng_echo pair lacks). One 1-byte sendto recurses through ng7s synchronous ng_snd_item/ng_apply_item forwarding, acquiring a per-node LWKT token per hop until td_toks[32] overflows: panic assertion \"ref < &td->td_toks_end\" failed in lwkt_gettoken_shared with ng_apply_item x31 in the DDB trace. Same framework defect as DF-3540 (ng_bpf instance); this is the constructible pure-topology instance. Root-gated (control sockets are caps_priv_checkd), deterministic, verified on the stock INVARIANTS guest.",
  "exploit_chain": "root builds graph with 3 control messages (mkpeer tee tap/left2right; mkpeer tee right/right; connect T1.left<->T2.left) + 1-byte sendto -> unbounded synchronous forwarding recursion -> LWKT token-array KKASSERT -> panic; machine dead in DDB. No uid=0 path: no memory corruption occurs before the always-on tripwire; trigger itself requires root.",
  "evidence": "panic.txt + console_full.txt (serial console: panic banner, CPU0 stopping CPUs, db>); ddb_trace.txt (live DDB trace via chardev-change serial socket: panic<-lwkt_gettoken_shared<-ng_apply_item x31<-ngthread); fix1_cycle.log (patched core survives 30s, RUN_RC=0)",
  "kernel_refs": [
    "sys/netgraph7/tee/ng_tee.c:293",
    "sys/netgraph7/tee/ng_tee.c:169",
    "sys/netgraph7/netgraph/ng_base.c:1961",
    "sys/netgraph7/netgraph/ng_base.c:1998",
    "sys/kern/lwkt_token.c:732"
  ],
  "poc_changes": "Authored fresh (no seed): one C source covering both ABIs (-DNG7 for this finding); graph = 2 mkpeers + 1 connect; entry via left2right; ng7 module stack built from clean /usr/src per DF-3540s harness pattern.",
  "attempts": 2,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:52 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 2400,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/netgraph7/netgraph && make && (cd ../socket && make) && (cd ../tee && make) && cc -O2 -DNG7 -o /root/poc/tee_cycle7 /root/poc/tee_cycle.c",
  "run_cmd": "kldload <full paths>/netgraph.ko ng_socket.ko ng_tee.ko && /root/poc/tee_cycle7",
  "code_hash": "d2fcdce4fbe488ca122665b7f4bc77e29181a82ee05c2874d52ebfa5ac31da5b",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fixed",
  "fix_evidence": "fix.diff (ng7 core el_hops + NG_HOPS_MAX=16, the validated core layer of DF-3540s fix) applied to guest /usr/src, modules rebuilt -Werror clean: same graph + injection -> sendto returns, RESULT no-panic survived 30s, RUN_RC=0, guest healthy (fix1_cycle.log); stock panics identically (console_full.txt). Pure-topology cycles cannot be rejected at the ng_tee node level, so the core bound is the correct layer.",
  "notes": "Contrast with DF-3540: no node-specific config needed here (no SET_PROGRAM), only CONNECT topology; entry edge exists because tee has 4 hooks. v1 twin is DF-3554 (terminal state differs: wedge instead of clean panic).",
  "recommended_fix": "Core hop bound on synchronous forwarding (el_hops/NG_HOPS_MAX in ng_snd_item) as in fix.diff; upstream may prefer queueing over recursion instead."
}