================== DF-0473 FIX VALIDATION (single-fix ipfw3.ko) ==================
Guest: DragonFly 6.5-DEVELOPMENT #0 (kernel unchanged); ipfw3.ko hot-swapped
       to the single-fix build (sha256 7b12bac3...d7c21eb, built -Werror rc=0).
       fix.diff = 2 hunks: call-site bounds+NULL check (ip_fw3.c:506) +
       install-time range validation (ip_fw3_ctl_add_rule:979).

--- BASELINE (unpatched #0 ipfw3.ko) --------------------------------------------
=== OOB rule add (module=0x80 opcode=0x80, cmd_len=2) ===
ADD_OOB_RULE rc=0 (OOB module/opcode rule ACCEPTED)        <-- BUG: rule installed
=== full oobcall PoC (install + enable fw + send pkt) ===
[+] install OOB-index rule: rc=0 (rule installed)
[+] enabling firewall (net.inet.ip.fw3.enable=1)...
<<< guest panics: Fatal trap 9 at ip_fw3_chk+0x1a4 (see panic.txt) >>>
=== legit rule add (module=0 opcode=0 ACCEPT) ===
ADD_LEGIT_RULE rc=0 (legitimate rule ACCEPTED)

--- PATCHED (single-fix ipfw3.ko) -----------------------------------------------
=== OOB rule add (module=0x80 opcode=0x80, cmd_len=2) -- hunk #2 install-time ===
ADD_OOB_RULE rc=-1 Invalid argument                        <-- FIXED: EINVAL
=== full oobcall PoC (install + enable fw + send pkt) ===
[+] install OOB-index rule: rc=-1 Invalid argument
[!] add failed -- cannot proceed
OOBCALL_EXIT=1    (firewall never enabled; NO PANIC; guest UP)
=== legit rule add (module=0 opcode=0 ACCEPT) -- no regression ===
ADD_LEGIT_RULE rc=0 (legitimate rule ACCEPTED)             <-- no regression
=== in-range/unregistered opcode (module=0 opcode=50, NULL filter_func) ========
    -- hunk #1 call-site NULL check, exercised independently
[+] install in-range/unregistered rule (module=0 opcode=50): rc=0 (accepted)
[+] enabling firewall + sending packet (PATCHED: NULL-skip, no panic)...
net.inet.ip.fw3.enable: 0 -> 1
[+] packet sent; if we reach here the call-site NULL check skipped the cmd
NULLCALL_EXIT=0   (guest UP; on unpatched this would NULL-deref panic)

==================================================================================
CLEAN BEFORE/AFTER: OOB rule ACCEPTED + panic on unpatched #0  =>  OOB rule
REJECTED (EINVAL) + no panic + legit rules unaffected on the single-fix module.
fix_status = fixed.  Both hunks exercised (hunk #2 rejects install; hunk #1
skips NULL/in-range-unregistered opcode at the call site).