# DF-3556 — ng_ipfw is unbuildable dead code (reachability context for DF-0735/DF-0736)

## What this pack is

Verification evidence (guest build attempts) for the pass-2 finding on
`sys/netgraph7/ng_ipfw.c`. This is an Info-level finding — Phase V
exploitation is not applicable (there is nothing to exploit; the code
cannot even compile). The pack exists to make the dead-code claim
reproducible.

## Claim

`sys/netgraph7/ng_ipfw.c` cannot be built into any kernel or module on
this tree, and even if it were hand-patched to compile, the ipfw core
never calls into it, so no packet can ever reach `ng_ipfw_input()` /
`ng_ipfw_rcvdata()`:

1. `ng_ipfw.c:44` — `#include <netinet/ip_fw.h>`: the header does not
   exist anywhere in `sys/` (ipfw lives in `sys/net/ipfw/` with
   `ip_fw.h` / `ip_fw2.h`). Fatal compile error, see `build.log`.
2. `sys/netgraph7/Makefile` SUBDIR has no `ipfw` entry → `ng_ipfw.ko`
   is not built by `make modules` / the module sweep.
3. `sys/conf/files:1712` (`optional netgraph7_ipfw`) +
   `sys/conf/options:315` (`NETGRAPH7_IPFW`) exist, but no kernel
   config in `sys/config/` enables it — and even if one did, the build
   would fail per (1).
4. `ng_ipfw_input_p` is referenced only by `ng_ipfw.c`/`ng_ipfw.h`
   themselves; `sys/net/ipfw/` never checks it. The ipfw
   "netgraph" rule action was never ported to DragonFly's ipfw.

Consequence: known findings **DF-0735** (ip_input/ip_output from
netgraph thread) and **DF-0736** (panic on forged tag dir) describe
real code-level defects but are **unreachable on any kernel buildable
from this tree** — they cannot manifest until someone un-rots the
module (fixes the include, re-adds the SUBDIR entry, and ports the
ipfw action), at which point they become live again.

## Reproduce

Guest, as root (see `build.log` for full output of the decisive run):

    mkdir -p /tmp/ngipfwtest && cd /tmp/ngipfwtest
    printf 'KMOD=\tng_ipfw\nSRCS=\tng_ipfw.c\nSYSDIR?=/usr/src/sys\nCWARNFLAGS+= -Wno-error\n\n.include <bsd.kmod.mk>\n' > Makefile
    cp /usr/src/sys/netgraph7/ng_ipfw.c /usr/src/sys/netgraph7/ng_ipfw.h .
    make

Expected: `ng_ipfw.c:44:10: fatal error: netinet/ip_fw.h: No such file
or directory` — compilation terminated.

Also verify no standard build path produces the module:

    grep -n ipfw /usr/src/sys/netgraph7/Makefile      # → no match
    grep -rn NETGRAPH7_IPFW /usr/src/sys/config/      # → no match

## Recommended fix

Either delete the rotted module, or port it properly: fix the include
to `net/ipfw/ip_fw2.h`, re-add the SUBDIR entry, add the
`ng_ipfw_input_p` hook to the ipfw core, and make
`ng_ipfw_findhook1()` take the full 32-bit `fwa->cookie` (currently
truncated to u_int16_t). If kept, DF-0735/DF-0736 must be fixed first
(netisr-thread hand-off for ip_input/ip_output; drop the panic on bad
dir).