============================================================
DF-0362 PoC — FIX VALIDATION (patched pf.ko on unpatched #0 kernel)
============================================================
Setup:
  - Kernel: DragonFly 6.5-DEVELOPMENT #0 (UNCHANGED — fix is module-only)
    sha256(/boot/kernel/kernel) = 5dc83dac19ad09effd6241c33e0c0669d41b6497ee92d87d3a2e45f287bc22ad
  - Fix applied to: sys/net/pf/pf_table.c (pfr_fix_anchor) via fix.diff
  - Built module-only: `cd /usr/src/sys/net/pf && make KERNCONF=X86_64_GENERIC`
  - Installed: /boot/kernel/pf.ko (patched, 350368 B)
  - Loaded via: kldload pf
  - sysctl debug.debugger_on_panic=0  (so panics land on serial + reboot)

AFTER (patched pf.ko) — 3 consecutive runs as root:
----------------------------------------------------
$ /root/poc-0362  [run 1]
DF-0362: triggering pfr_fix_anchor size_t wrap via DIOCRGETTABLES...
  pfrt_anchor = 1024 '/' ; pfrt_name = {'/',0,...}; off will reach 1025
  siz - off = 1024 - 1025 wraps size_t -> bcopy(...,SIZE_MAX) -> panic
DF-0362: ioctl returned rc=-1 (Permission denied)
RUN_EXIT=0
[guest stays up; id=uid=1001(maxx) confirmed after each run]

  [runs 2 and 3] — byte-identical output. No panic. Guest up.

boot.log delta across all 3 runs: 0 bytes (no kernel messages, no panic).

BEFORE (on same boot — control) — unpatched pf.ko:
---------------------------------------------------
Source patch reverted with `patch -p1 -R`, pf.ko rebuilt from pristine
source, kldunload + kldload, then:

$ /root/poc-0362
DF-0362: triggering pfr_fix_anchor size_t wrap via DIOCRGETTABLES...
  ... (same PoC output) ...

[ssh RC=124 after 30s — guest has panicked. ssh dfbsd-maxx:
 "kex_exchange_identification: read: Connection reset by peer"]

boot.log delta immediately after, then a fresh boot loader screen:
  Fatal trap 12:XMMNNOO-\|/-\|/- ... (reboot)
  [panic output truncated by fast auto-reset; full signature captured
   earlier in this session — see panic.txt]

(The full panic signature, captured on an earlier identical run with the
unpatched pf.ko on the same kernel, is in panic.txt:
  panic: vm_fault: fault on stack guard, addr: 0xfffff8011795a000
  memmove() at memmove+0x24f
  pfr_get_tables() at pfr_get_tables+0x31
)

VERDICT
-------
BEFORE (unpatched pf.ko): PoC panics the kernel (memmove page-fault
                           inside pfr_fix_anchor's bcopy, trap 12).
AFTER  (patched pf.ko):   PoC returns rc=-1 cleanly. 3/3 runs, no panic.

=> The fix closes the bug. fix_status = fixed.