=== DF-0457: ng_pppoe unchecked ph->length -> heap OOB read ===

Actual mbuf payload: 4 bytes after tag[0] start
ph->length claims: 2000 bytes after tag[0] start

Searching for tag 0x0101 (Service-Name):
  Found tag type=0x0101 at step 1

Searching for tag 0xFFFF (non-existent — forces full walk):

  BUG CONFIRMED: get_tag walks up to ph->length bytes past tag[0],
  reading adjacent kernel heap. The m_pullup+contiguity check at
  ng_pppoe.c:952-968 does NOT bound ph->length vs actual data.

  Additionally, scan_tags + insert_tag(PTT_RELAY_SID) + make_packet
  copies up to 1500 bytes of the inflated buffer into the response,
  leaking kernel heap to the attacker via Relay-Session-Id.
RUN_EXIT=0