# DF-5796 VERDICT

**Status: reproduced** (the ungated shared-cluster write primitive);
impact ceiling: cross-packet data-integrity corruption on bridged
networks (remote-triggerable), memory-safe (writes stay in cluster
bounds) — recorded impact "none" in the enum, integrity notes here.

## What was run

Same rig (`mbuf_probe.ko`, probe_5796) on the live DF 6.5-DEVELOPMENT
guest (production non-INVARIANTS kernel).

## What happened (run.log)

```
DF5796: cluster shared, m_sharecount(a)=2 (M_WRITABLE=0)
DF5796: REPRODUCED: m_copyback through shared cluster rewrote the other
        mbuf's data: a[0]=0x5a (expected 0x41)
```

* `a` = `m_getcl` pkthdr+cluster filled with 0x41; `b` = `m_copym(a, 0,
  M_COPYALL)` → both share the cluster (`m_sharecount=2`,
  `M_WRITABLE(a)==0`).
* `m_copyback(b, 0, 16, 0x5A…)` executed `_m_copyback2`'s second-loop
  `bcopy(cp, mtod(m)+off, mlen)` (uipc_mbuf.c:2368-2369) — no
  M_WRITABLE/m_sharecount gate exists anywhere on the path.
* Read back through `a`: first byte 0x5a.  The write crossed the mbuf
  boundary into the other owner's packet.  Primitive proven.

## Production trigger (code-cited, not driven end-to-end on the guest)

`bridge_output()` if_bridge.c:4464-4471 rewrites `ether_shost` in place
with `m_copyback` on bridge-forwarded frames; bridge flooding first
duplicates frames via `m_copypacket` (if_bridge.c:2317/3056/3208/3274),
and `m_copypacket` shares clusters (uipc_mbuf.c:1647-1652
ext_ref+ext-copy).  Flood copies dispatched to different member ports
take different rewrite branches inside one shared cluster; last write
wins for untransmitted copies → wrong source MAC emitted on the wire →
switch MAC-table poisoning / L2 blackholing.  Any ARP/broadcast frame
into a bridge member triggers it; no auth.  (End-to-end L2 impact not
exercised on the single-NIC audit guest — the primitive plus the call
graph is the evidence.)

## Why not higher severity

Writes stay inside cluster bounds (mlen ≤ m->m_len - off), so this is
integrity, not memory corruption.  No uaf/overflow primitive follows
from it.

## Fix validation

Not performed (no kernel rebuild): not a reproduced memory-corruption
finding.  fix.diff adds an INVARIANTS KASSERT at the ungated bcopy;
durable remediation is caller-side (unshare before rewrite; make
bridge_output's shost rewrite operate on a private head mbuf).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.