{
  "finding_id": "DF-4080",
  "title": "oce_detach frees ifp (if_free) while interrupts are still enabled and EQ0 deliberately re-armed by oce_if_deactivate: async MCC event in the window reaches oce_mq_handler -> if_link_state_change on the freed ifnet (use-after-free)",
  "verdict": "reproduced",
  "impact": "panic (use-after-free: post-free interrupt dispatch on the freed ifnet — UAF stat writes, UAF if_input delivery, slot-reuse alias, and a Fatal trap 12 through the freed-then-reallocated ifnet)",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh   (make -m /usr/src/share/mk; KLD only — extern-binds the running kernel's own oce teardown/handlers; nm-injects static oce_intr)",
    "run": "sh run.sh probe   (survives: HOSTINTR_MASK SET, EQ armed, ifnet FREED, late oce_intr dispatch, UAF writes 0->1, chain via freed ifnet, slot-reuse alias); fresh boot + sh run.sh panic   (Fatal trap 12 at ip=0x0)",
    "expected": "probe: all markers above + SURVIVED; panic: 'Fatal user address access from kernel mode from sysctl at 0' / Fatal trap 12, ip=0x8:0x0 after 'slot reuse ... its if_input is now 0'"
  },
  "kernel_refs": [
    "sys/dev/netif/oce/oce_if.c:322",
    "sys/dev/netif/oce/oce_if.c:340",
    "sys/dev/netif/oce/oce_if.c:342",
    "sys/dev/netif/oce/oce_if.c:553",
    "sys/dev/netif/oce/oce_if.c:2017",
    "sys/dev/netif/oce/oce_if.c:2018",
    "sys/dev/netif/oce/oce_if.c:2065",
    "sys/dev/netif/oce/oce_if.c:1354",
    "sys/dev/netif/oce/oce_if.c:1373",
    "sys/dev/netif/oce/oce_if.c:1606",
    "sys/dev/netif/oce/oce_hw.c:345"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df4080_oce_poc.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "panic.txt",
    "panic_console_full.log", "fix.diff", "fix_build.log", "fix_run.log",
    "env.txt", "manifest.json", "verdict.json"
  ]
}