DF-3545 — ng_sample (ng7) downstream hook misclassified as DLCI 0

Verdict: REPRODUCED (functional misroute/reflection; no memory-safety impact)

struct XXX_hookinfo downstream_hook is zeroed by the constructor's M_ZERO kmalloc (sys/netgraph7/ng_sample.c:158-165) and ng_xxx_newhook never sets downstream_hook.dlci = -1 (ng_sample.c:232-236), although both the struct comment (ng_sample.c:125: "-1 == downstream") and the data-path dispatch (ng_sample.c:341: if (dlci != -1)) require exactly that. Every packet arriving on the downstream hook therefore takes the DLCI-egress branch:

if (dlci != -1) {          /* 0 != -1 -> TRUE for downstream */
        NG_FWD_NEW_DATA(error, item, xxxp->downstream_hook.hook, m);
        xxxp->packets_out++;

(ng_sample.c:341-350) and is reflected straight back out the same hook it arrived on, instead of running the intended decode/demux branch (:351-376), which is unreachable dead code. Counters are also wrong (packets_out instead of packets_in).

Live confirmation on the guest (ng7 base + ng_socket + ng_sample modules built from /usr/src/sys/netgraph7 and loaded):

RESULT: REFLECTED - received 64 bytes back: 'PING\n'
GET_STATUS: packets_in=0 packets_out=1

sampledemo.c connects a data socket to sample:downstream, writes PING, and reads the same frame back on the same socket (run.log).

Impact ceiling: none beyond misrouting/reflection inside a graph an administrator explicitly built with this node. ng_sample is the netgraph template ("sample"/xxx node type): it builds (RC=0, module-build.log) and loads, but it does not ship — it is in no SUBDIR of sys/netgraph7/Makefile, has no sys/conf/files entry, and /boot/kernel contains no ng_sample.ko. Known finding DF-0690 (debug-hook mbuf+item leak) covers the other dormant-template defect in this file and is not re-reported here.

Fix

Set the sentinel in newhook (fix.diff). (Optionally also clear xxxp->debughook on debug-hook disconnect — noted in the audit as a latent-but-unused dangling pointer; debughook is never read, so it is recorded as a negative note rather than a finding.)

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.