# DF-0260 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: ipfw_setup_local only m_pullup's hlen+sizeof(tcphdr) for TCP, but tcpopts_match walks th_off options past that; non-TCP/UDP/ICMP get no pullup at all -> reads up to 40 bytes past the contiguous region. Remote defense-in-depth read.

## Impact ceiling
none

## Cited refs
- sys/net/ipfw/ip_fw2.c:3323
- sys/net/ipfw/ip_fw2.c:1301

## Fix
PULLUP_TO(hlen + (th_off<<2)) when th_off indicates TCP options present.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.