{
  "finding_id": "DF-4432",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "sln_rx() passes a NULL mbuf to ifp->if_input() when m_devget() fails (if_sln.c:915/928 NULL branches fall through to the unconditional call at if_sln.c:949); ether_input() panics (M_ASSERTPKTHDR KASSERT on INVARIANTS kernels, NULL m->m_len deref on production GENERIC, if_ethersubr.c:1494/1502). The ancestor driver rl(4) guards this exact pattern (if_rl.c:1095-1096 if (m == NULL) continue;); the sln(4) port dropped the guard. The faulting statement was replicated verbatim (if_input(ifp, NULL, NULL, -1)) on the guest production kernel via KLD module and panicked it inside kldload with the predicted backtrace (ether_input+0x197). The in-driver precondition (m_devget M_NOWAIT failure at RX-interrupt time = kernel cluster pressure + incoming traffic on sln0) is code-certain (uipc_mbuf.c:2247-2249) but hardware-gated on this guest (no SC92031). Kernel DoS: recurring unattended panics on any host with an sln(4) NIC under memory pressure.",
  "exploit_chain": "local user induces kernel mbuf/cluster pressure (ordinary socket spray) while any traffic arrives on the sln(4) interface -> RX interrupt -> sln_rx -> m_devget(M_NOWAIT) fails, returns NULL -> if_sln.c:949 calls if_input(ifp, NULL,...) -> ether_input KASSERT/NULL deref -> kernel panic (DoS). Proven on guest by replica module executing the exact statement; no uid0 route exists (fixed NULL address, panic-only).",
  "evidence": "panic.txt (serial console: DF-4432 replica... then panic: ether_input: invalid mbuf or no mbuf packet header!, backtrace ether_input+0x197 <- dfrn_modevent+0xd0 <- module_register_init); run.log (ssh never returned; guest down after run); VERDICT.md (full chain); fix.diff (guard the if_input call, verified git-apply --check clean)",
  "kernel_refs": [
    "sys/dev/netif/sln/if_sln.c:949",
    "sys/dev/netif/sln/if_sln.c:913",
    "sys/dev/netif/sln/if_sln.c:926",
    "sys/dev/netif/sln/if_sln.c:915",
    "sys/dev/netif/sln/if_sln.c:928",
    "sys/kern/uipc_mbuf.c:2247",
    "sys/net/if_ethersubr.c:1494",
    "sys/net/if_ethersubr.c:1502",
    "sys/net/if_ethersubr.c:642",
    "sys/dev/netif/rl/if_rl.c:1095"
  ],
  "poc_changes": "Seed-to-working: module had to be built in-tree (guest /usr/src/sys has no modules/ subtree in the snapshot; SYSDIR must be passed absolute or kern.fwd.mks !=-glob evaluates from the wrong cwd); added <net/if_types.h> include for IFT_ETHER; Makefile uses .include \"/usr/src/sys/conf/kmod.mk\".",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026\troot@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
  "runtime_sec": 180,
  "guest_dirty": 0,
  "build_cmd": "cd /usr/src/sys/modules/dfrnull && make SYSDIR=/usr/src/sys",
  "run_cmd": "kldload /usr/src/sys/modules/dfrnull/dfrnull.ko",
  "code_hash": "acd809fcfcca11e1278e8cdc0ebeed4203da8b1d9c003c1e573dbd76383be81b",
  "notes": "Guest reset with-src after the panic (clean). fix validation not testable on this guest: exercising the fixed sln_rx path requires SC92031 hardware (absent in QEMU); the replicas panic site (ether_input) is correct kernel behavior that the fix prevents sln from ever reaching with NULL.",
  "recommended_fix": "Guard the if_input call on m != NULL in sln_rx (do NOT `continue`: the rx_offset advance at if_sln.c:951 must still run) - see findings/poc/DF-4432/fix.diff",
  "fix_status": "not_testable",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored and verified git-apply-clean against sys/; patched-path validation impossible on this guest (no SC92031 NIC, so sln_rx cannot be driven); the baseline panic was reproduced and the fix removes the only NULL path into if_input on the sln RX path.",
  "fix_evidence": "findings/poc/DF-4432/fix.diff (git apply --check clean); VERDICT.md Fix section"
}