# DF-0391 — pf_fragcache m_dup NULL-deref trigger

## Bug (certain by inspection)
`sys/net/pf/pf_norm.c:661-666` (pf_fragcache, the `precut > 0` overlap path):
```c
*m0 = m_dup(m, M_NOWAIT);
/* From KAME Project : We have missed this! */
m_adj(*m0, (h->ip_hl << 2) - (*m0)->m_pkthdr.len);   /* <-- derefs *m0 */
if (*m0 == NULL)                                       /* <-- check too late */
    goto no_mem;
```
The argument expression of `m_adj` evaluates `(*m0)->m_pkthdr.len` BEFORE
the NULL-check on the next line. The "We have missed this!" KAME comment
acknowledges the corner but the ordering is still wrong.

## Trigger requirements
1. `pf.ko` loaded (root: `kldload pf`).
2. A PF rule with `scrub ... fragment crop` (`PFRULE_FRAGCROP`) — non-default.
3. Two IP fragments where the second overlaps the cached first (enters
   `precut > 0`).
4. `m_dup(m, M_NOWAIT)` returning NULL — i.e., mbuf-pressure on the system.

## Build / Run
```
cc -O2 -Wall -o df_0391_fragcache df_0391_fragcache.c
```
Setup as root:
```
kldload pf
cat > /etc/pf-0391.conf <<EOF
scrub in on lo0 all fragment crop
pass in on lo0 all
pass out all
EOF
pfctl -d; pfctl -F all; pfctl -f /etc/pf-0391.conf; pfctl -e
./df_0391_fragcache
```

## Expected
* Path reachability (always observable): `pfctl -s info` shows non-zero
  `normalize` counter (pf_normalize_ip called) and non-zero `fragment`
  counter (overlap detected, fragcache `precut > 0` path entered).
* Live panic (non-deterministic): only if `m_dup(M_NOWAIT)` returns NULL.
  On DragonFly the objcache transparently refills from the master allocator
  before failing, so NULL is hard to provoke even when `objcache ... exhausted`
  warnings appear in dmesg.
* FIX: reorder the NULL check before the `m_adj` argument expression.

## Reality
Code-certain CWE-476; fragcache path reachable on default GENERIC + loaded
pf.ko with a non-default `fragcrop` scrub rule; live panic requires sustained
memory pressure that defeats DragonFly's objcache refill. Non-default-config
remote DoS (CWE-476) — realistic threat for admins who deploy `scrub crop`.