{
  "finding_id": "DF-4106",
  "title": "vge_rxeof SOF branch ignores vge_newbuf failure: mbuf double-referenced by head chain and RX ring -> double-free/UAF/double-queued chain -> aliased live kernel objects",
  "verdict": "reproduced",
  "impact": "panic (memory-corruption class: double free / UAF / cross-object aliasing; hard kernel trap steerable through the aliased object)",
  "confidence": "certain",
  "reproduce": {
    "build": "sh build.sh   (make -m /usr/src/share/mk; KLD only, no driver code)",
    "run": "kldload ./df4106_vge_poc.ko && sh run.sh baseline   (panic variant: sh run.sh panic on a fresh boot)",
    "expected": "DOUBLE-REFERENCE / CYCLE DETECTED / DOUBLE FREE / DANGLING entries walked / freed mbufs delivered to if_input / ALIAS CONFIRMED (x2); panic variant: Fatal trap 9 at m_free+0x10 following the steered m_next; fixed kernel: NO ALIAS FOUND"
  },
  "kernel_refs": [
    "sys/dev/netif/vge/if_vge.c:1294",
    "sys/dev/netif/vge/if_vge.c:1285",
    "sys/dev/netif/vge/if_vge.c:1328",
    "sys/dev/netif/vge/if_vge.c:1334",
    "sys/dev/netif/vge/if_vge.c:1161",
    "sys/dev/netif/vge/if_vge.c:2102",
    "sys/dev/netif/vge/if_vge.c:2118",
    "sys/dev/netif/vge/if_vge.c:1395",
    "sys/dev/netif/vge/if_vge.c:1837",
    "sys/kern/uipc_mbuf.c:1377"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "df4106_vge_poc.c", "Makefile",
    "build.sh", "run.sh", "build.log", "run.log", "run.2.log", "run.3.log",
    "panic.txt", "fix.diff", "fix_build.log", "fix_run.log", "fix_dmesg.txt",
    "env.txt", "manifest.json", "verdict.json"
  ]
}