=== DF-0429 demonstration: PFSYNC_ACT_UREQ (id=0,creatorid=0) bulk-dump trigger ===
=== Guest: DragonFly 6.5-DEVELOPMENT #0 (with-src, UNPATCHED), pf.ko loaded, pf enabled, pfsync0 present ===

uname: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  x86_64

--- handler registration check (the crux) ---
nm /boot/kernel/kernel.debug | grep -w pfsync_input
  => ABSENT from static kernel (pfsync_input is dead code)
nm /boot/kernel/pf.ko | grep pfsync_input
  => 0000000000003040 T pfsync_input   (symbol exists in module, but unreferenced)
nm /boot/kernel/pf.ko | grep -E 'inetsw|protosw|pfsyncattach'
  => 0000000000001120 T pfsyncattach   (no inetsw/protosw ref => pf.ko does NOT register proto-240)

reason: in_proto.c:281 `#ifdef NPFSYNC` ... in_proto.c:296 `#endif` wraps the only
        `.pr_input = pfsync_input` registration; NPFSYNC is never #defined anywhere in
        sys/ (grep -rn NPFSYNC sys/ returns ONLY the two gate lines). => block compiled out.

--- BEFORE ---
netstat -sp ip | grep unknown/unsupported:   0 packets for unknown/unsupported protocol
netstat -sp pfsync:                          (empty — no pfsync protocol registered at all)
pfctl -s states | wc -l:                     0

--- INJECT (as root, raw socket) ---
$ /home/maxx/poc/DF-0429/inject_ureq 10.0.2.99 224.0.0.240
sent 56 bytes: 10.0.2.99 -> 224.0.0.240  proto=240 ttl=255 act=UREQ id=0 creatorid=0 (bulk-dump trigger)

--- AFTER (sleep 2) ---
netstat -sp ip | grep unknown/unsupported:   0 packets for unknown/unsupported protocol
netstat -sp pfsync:                          (still empty — pfsyncs_ipackets NEVER incremented)
pfctl -s states | wc -l:                     0
dmesg tail:                                  (no "received bulk update request", no bulk dump, no panic)

=== RESULT ===
The PFSYNC_ACT_UREQ packet DF-0429 describes (id==0 && creatorid==0, if_pfsync.c:916)
CANNOT reach pfsync_input because pfsync_input is not registered as the proto-240
handler on this kernel. ip_protox[240] resolves to the RAW wildcard (rip_input).
No bulk state-table dump occurred. pfsyncstats stayed empty. => DF-0429 NOT REPRODUCED
(dead code; same root cause as sibling DF-0428).