=== DF-0509: ng_ksocket_sockaddr_unparse pathlen underflow ===

SADATA_OFFSET = offsetof(sockaddr_un, sun_path) = 2

sun_len=0:
  ng_ksocket sanity (arglen=2): PASSES (weak)
  pathlen = 0 - 2 = -2
  -> bcopy size = (size_t)-2 = 0xfffffffffffffffe -> MASSIVE overflow!
  unp_bind validation: REJECTS (EINVAL)

sun_len=1:
  ng_ksocket sanity (arglen=2): PASSES (weak)
  pathlen = 1 - 2 = -1
  -> bcopy size = (size_t)-1 = 0xffffffffffffffff -> MASSIVE overflow!
  unp_bind validation: REJECTS (EINVAL)

sun_len=2:
  ng_ksocket sanity (arglen=2): PASSES (weak)
  pathlen = 2 - 2 = 0
  unp_bind validation: REJECTS (EINVAL)

sun_len=3:
  ng_ksocket sanity (arglen=2): FAILS
  pathlen = 3 - 2 = 1
  unp_bind validation: ACCEPTS

sun_len=5:
  ng_ksocket sanity (arglen=2): FAILS
  pathlen = 5 - 2 = 3
  unp_bind validation: ACCEPTS

sun_len=10:
  ng_ksocket sanity (arglen=2): FAILS
  pathlen = 10 - 2 = 8
  unp_bind validation: ACCEPTS

=== CONCLUSION ===
For sun_len < 2:
  ng_ksocket BIND sanity PASSES (bug)
  BUT unp_bind REJECTS with EINVAL (defense-in-depth)
  -> sockaddr never stored -> unparse never sees it
  -> NOT triggerable on DragonFly

RECOMMENDATION: Harden ng_ksocket sanity check anyway (fix.diff).
CLASSIFICATION: FALSE POSITIVE (latent bug, blocked by unp_bind).
RUN_EXIT=0