DF-3556 — ng_ipfw is unbuildable dead code (reachability context for DF-0735/DF-0736)

What this pack is

Verification evidence (guest build attempts) for the pass-2 finding on sys/netgraph7/ng_ipfw.c. This is an Info-level finding — Phase V exploitation is not applicable (there is nothing to exploit; the code cannot even compile). The pack exists to make the dead-code claim reproducible.

Claim

sys/netgraph7/ng_ipfw.c cannot be built into any kernel or module on this tree, and even if it were hand-patched to compile, the ipfw core never calls into it, so no packet can ever reach ng_ipfw_input() / ng_ipfw_rcvdata():

1. ng_ipfw.c:44 — #include <netinet/ip_fw.h>: the header does not exist anywhere in sys/ (ipfw lives in sys/net/ipfw/ with ip_fw.h / ip_fw2.h). Fatal compile error, see build.log.
2. sys/netgraph7/Makefile SUBDIR has no ipfw entry → ng_ipfw.ko is not built by make modules / the module sweep.
3. sys/conf/files:1712 (optional netgraph7_ipfw) + sys/conf/options:315 (NETGRAPH7_IPFW) exist, but no kernel config in sys/config/ enables it — and even if one did, the build would fail per (1).
4. ng_ipfw_input_p is referenced only by ng_ipfw.c/ng_ipfw.h themselves; sys/net/ipfw/ never checks it. The ipfw "netgraph" rule action was never ported to DragonFly's ipfw.

Consequence: known findings DF-0735 (ip_input/ip_output from netgraph thread) and DF-0736 (panic on forged tag dir) describe real code-level defects but are unreachable on any kernel buildable from this tree — they cannot manifest until someone un-rots the module (fixes the include, re-adds the SUBDIR entry, and ports the ipfw action), at which point they become live again.

Reproduce

Guest, as root (see build.log for full output of the decisive run):

mkdir -p /tmp/ngipfwtest && cd /tmp/ngipfwtest
printf 'KMOD=\tng_ipfw\nSRCS=\tng_ipfw.c\nSYSDIR?=/usr/src/sys\nCWARNFLAGS+= -Wno-error\n\n.include <bsd.kmod.mk>\n' > Makefile
cp /usr/src/sys/netgraph7/ng_ipfw.c /usr/src/sys/netgraph7/ng_ipfw.h .
make

Expected: ng_ipfw.c:44:10: fatal error: netinet/ip_fw.h: No such file or directory — compilation terminated.

Also verify no standard build path produces the module:

grep -n ipfw /usr/src/sys/netgraph7/Makefile      # → no match
grep -rn NETGRAPH7_IPFW /usr/src/sys/config/      # → no match

Recommended fix

Either delete the rotted module, or port it properly: fix the include to net/ipfw/ip_fw2.h, re-add the SUBDIR entry, add the ng_ipfw_input_p hook to the ipfw core, and make ng_ipfw_findhook1() take the full 32-bit fwa->cookie (currently truncated to u_int16_t). If kept, DF-0735/DF-0736 must be fixed first (netisr-thread hand-off for ip_input/ip_output; drop the panic on bad dir).