{
  "finding_id": "DF-4941",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "Source-proven error-path defect, not executed: SIOCSIFMTU (if_ic.c:205-223) kfree()s the working ic_obuf/ic_ifbuf pair and installs the new kmalloc results without any NULL check or rollback, and still updates if_mtu. DF kmalloc CAN return NULL here despite M_WAITOK (sizes up to 65539 B admitted by if.c:2272; >=ZoneLimit path returns NULL on kmem_slab_alloc failure, kern_slaballoc.c:942-950; zone-create failure likewise, :1070-1072), so under kernel-memory pressure `ifconfig ic0 mtu 65535` deterministically leaves the interface with NULL buffers — arming the DF-2001 NULL-deref sinks (icoutput:358 bcopy, icintr:309 write) for a panic on the next packet/byte. PoC not executed because the trigger requires kmem exhaustion (risk of wedging the shared guest); root cause fully cited path:line. Fix authored (allocate-first with M_NULLOK, ENOBUFS rollback) but not runtime-validated.",
  "exploit_chain": "",
  "evidence": "VERDICT.md root-cause trace: if_ic.c:211-222 (unchecked kmallocs, free of working pair, mtu update); kern_slaballoc.c:942-950 and 1070-1072 (M_WAITOK NULL paths); if.c:2272 (bounds admitting 65535).",
  "kernel_refs": [
    "sys/dev/netif/ic/if_ic.c:205-223",
    "sys/dev/netif/ic/if_ic.c:358",
    "sys/dev/netif/ic/if_ic.c:309",
    "sys/net/if.c:2261-2292",
    "sys/kern/kern_slaballoc.c:942-950",
    "sys/kern/kern_slaballoc.c:1070-1072"
  ],
  "poc_changes": "No PoC executed (deliberate): deterministic trigger requires kernel-memory exhaustion; documented as untested with full source trace instead.",
  "attempts": 0,
  "guest_uname": "not-booted-for-this-finding (guest used for DF-4939/DF-4940 was DragonFly dfbsd 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 x86_64)",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "n/a",
  "run_cmd": "n/a (hypothetical: force kmem pressure, then `ifconfig ic0 mtu 65535`; expect ic_obuf/ic_ifbuf NULL with if_mtu changed; next traffic panics at if_ic.c:358/309)",
  "code_hash": "9b7845645f2f12e0ec8dc839c563d67a52dcd4ba11685707630da81c74b5c737",
  "notes": "Severity Low: privileged trigger + kmem-pressure precondition; impact ceiling local panic (DoS) via the DF-2001 sinks (cited, not re-claimed). Same virtual-i2c harness as DF-4939/DF-4940 would host the interface if a runtime validation is ever wanted.",
  "recommended_fix": "Allocate replacement buffers with M_WAITOK|M_NULLOK before freeing the working pair; on failure free only the new allocations and return ENOBUFS without changing if_mtu (fix.diff).",
  "fix_status": "not_tested",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff authored from line-accurate root cause (allocate-first, ENOBUFS rollback, M_NULLOK); not runtime-validated because the baseline failure path itself could not be triggered without risking the shared guest.",
  "fix_evidence": "fix.diff"
}