=== BASELINE kernel kern.version ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026
=== Setup ===
kldload pf
echo "scrub in on lo0 all fragment crop" > /etc/pf-0391.conf (+ pass rules)
pfctl -f /etc/pf-0391.conf ; pfctl -e

=== Run as root (sender: raw IP frags to 127.0.0.1) ===
Two overlapping fragments per round (off=0/MF, off=8/no-MF), each round with new ip_id,
with concurrent mbuf-pressure children. See df_0391_fragcache.c.

=== pfctl -s info (after ~6s of running) ===
Status: Enabled for 0 days 00:00:41           Debug: Urgent
Counters
  match                               1406
  fragment                               1     <-- pf detected an overlapping fragment
  normalize                           1066     <-- pf_normalize_ip + fragcache path entered
  memory                                 0     <-- no m_dup NULL failure

=== dmesg during run ===
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu1!    <-- pressure WAS applied
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu2!
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu3!
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu4!
Warning: objcache(mbuf pkthdr+cl) exhausted on cpu5!

=== Observation ===
The fragcache overlap path IS reached (normalize 1066, fragment 1).
The mbuf pool IS exhausted (objcache warnings on all CPUs).
But m_dup(M_NOWAIT) did NOT return NULL — DragonFly's objcache transparently
refills from the master allocator before failing, so the NULL-deref condition
was not hit. No panic occurred. The bug is CERTAIN by code inspection
(sys/net/pf/pf_norm.c:663-664 dereferences *m0 before the NULL check at :665)
but the live trigger is non-deterministic on this guest.