{
  "finding_id": "DF-4082",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "certain",
  "verdict": "oce_tx returns 0 (success) when oce_insert_vlan_tag fails on !M_WRITABLE mbufs (oce_if.c:833-840, NULL source at 2207-2208): oce_start_locked (1129-1147) then taps BPF and dequeues the next packet, so the mbuf is leaked and the packet silently dropped under a false success. Requires the BE3-A1 + QnQ/UMC + IPv6-ext-hdr + read-only-mbuf profile. Untested: hardware-gated (no oce NIC in QEMU); one-line fix.",
  "exploit_chain": "",
  "evidence": "README.md, VERDICT.md. Key lines: oce_if.c:833-840 (return 0 on failure), 2207-2208 (NULL path), 1134-1145 (caller trusts rc==0).",
  "kernel_refs": ["sys/dev/netif/oce/oce_if.c:833", "sys/dev/netif/oce/oce_if.c:837", "sys/dev/netif/oce/oce_if.c:2207", "sys/dev/netif/oce/oce_if.c:1134"],
  "poc_changes": "No runnable PoC: hardware-gated (BE3-A1/UMC profile).",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": null,
  "run_cmd": null,
  "code_hash": null,
  "notes": "Impact ceiling on affected hardware: mbuf/cluster leak (memory-exhaustion DoS) + silent packet drop, driven by ordinary IPv6 ext-header traffic. Severity Low due to the extremely narrow trigger profile.",
  "recommended_fix": "Return ENOBUFS (not 0) when oce_insert_vlan_tag fails so the caller requeues/frees the mbuf.",
  "fix_status": "not_applicable",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Fix validation not possible: no OneConnect hardware/emulation in QEMU.",
  "fix_evidence": "Guest pciconf -l: no 0x19a2/0x10df devices."
}