=== DF-0430 demonstration: PFSYNC_ACT_CLR (ifname="",creatorid=0xdeadbeef) mass-delete trigger ===
=== Guest: DragonFly 6.5-DEVELOPMENT #0 (with-src, UNPATCHED), pf.ko loaded, pf enabled, pfsync0 present ===

uname: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026  x86_64

--- handler registration check (the crux) ---
nm /boot/kernel/kernel.debug | grep -w pfsync_input
  => ABSENT from static kernel (pfsync_input is dead code)
nm /boot/kernel/pf.ko | grep pfsync_input
  => 0000000000003040 T pfsync_input   (symbol exists in module, but unreferenced)
nm /boot/kernel/pf.ko | grep -E 'inetsw|protosw|pfsyncattach'
  => 0000000000001120 T pfsyncattach   (no inetsw/protosw ref => pf.ko does NOT register proto-240)

reason: in_proto.c:281 `#ifdef NPFSYNC` ... in_proto.c:296 `#endif` wraps the only
        `.pr_input = pfsync_input` registration; NPFSYNC is never #defined anywhere in
        sys/ (grep -rn NPFSYNC sys/ returns ONLY the two gate lines). => block compiled out.

--- BEFORE ---
netstat -sp ip | grep unknown/unsupported:   0 packets for unknown/unsupported protocol
netstat -sp pfsync:                          (empty — no pfsync protocol registered at all)
pfctl -s states | wc -l:                     0

--- INJECT (as root, raw socket) ---
$ /home/maxx/poc/DF-0430/inject_clr 10.0.2.99 224.0.0.240 0xdeadbeef
sent 64 bytes: 10.0.2.99 -> 224.0.0.240  proto=240 ttl=255 act=CLR ifname="" creatorid=0xdeadbeef (mass-delete trigger)

--- AFTER (sleep 2) ---
netstat -sp ip | grep unknown/unsupported:   0 packets for unknown/unsupported protocol
netstat -sp pfsync:                          (still empty — pfsyncs_ipackets NEVER incremented)
pfctl -s states | wc -l:                     0
dmesg tail:                                  (no state deletion, no panic)

=== RESULT ===
The PFSYNC_ACT_CLR/DEL/DEL_C packets DF-0430 describes (if_pfsync.c:542-608 / :749 / :873)
CANNOT reach pfsync_input because pfsync_input is not registered as the proto-240
handler on this kernel. ip_protox[240] resolves to the RAW wildcard (rip_input).
No pf state was deleted. pfsyncstats stayed empty. => DF-0430 NOT REPRODUCED
(dead code; same root cause as sibling DF-0428).