============================================================
DF-0362 PoC — BUILD LOG (final successful build)
============================================================
Guest: DragonFly 6.5-DEVELOPMENT #0, gcc 8.3 [DragonFly]
Source: poc/DF-0362/poc.c (uses guest /usr/include/net/pf/pfvar.h)

$ cc -o poc poc.c
(exit 0)

$ ls -l poc
-rwxr-xr-x  1 maxx  maxx  9064 Jul 16 10:48 poc

Build notes
-----------
* Includes <net/if.h> (for IFNAMSIZ) before <net/pf/pfvar.h>.
* Uses the guest's installed <net/pf/pfvar.h> for byte-accurate struct
  layout (struct pfioc_table has void *pfrio_buffer, 4 ints, u_int32_t
  ticket; sizeof = 1104 bytes) and the correct ioctl number
  DIOCRGETTABLES = _IOWR('D', 63, struct pfioc_table).

Iteration history (4 distinct build attempts)
----------------------------------------------
1. Original scaffolded PoC had:
     - wrong DIOCRGETTABLES number (66, which is DIOCRCLRADDRS)
     - wrong struct pfioc_table (pfrio_buffer was int, not void *)
   => rebuilt using real guest kernel headers.
2. Build error: 'IFNAMSIZ' undeclared (pfvar.h uses it in struct
   pfioc_iface).
   => added #include <net/if.h>. Build clean.
3. First run: ioctl returned ENODEV (pfrio_esize==0 fails the
   pf_ioctl.c:2433 size check before pfr_fix_anchor is reached).
   => set io.pfrio_esize = sizeof(struct pfr_table).
4. Second run: panic (see run.log). Confirmed reproduction.