=== icmplim = 200 (per-sec cap that SHOULD apply but doesn't) ===
=== sending 2000 bad-IP-option packets as unpriv user ===
DF-0518: check `netstat -s | grep icmp` — 'calls to icmp_error' should have climbed to ~2000.
DF-0518: if the icmplim=200 cap applied it would have plateaued at ~200/sec.  It does NOT plateau on the buggy kernel because icmp_error() has no rate-limit.

=== tcpdump summary ===
tcpdump: listening on lo0, link-type NULL (BSD loopback), snapshot length 262144 bytes
0 packets captured
2200 packets received by filter
0 packets dropped by kernel

icmplim (per-sec cap that SHOULD apply):   200
ICMP errors emitted during the ~0.02s burst: 2200 (received-by-filter)
ICMP errors captured in pcap:              0

*** DF-0518 REPRODUCED: 2200 ICMP errors emitted in <1s,
    far exceeding icmplim=200.  icmp_error() has no rate-limit.
RUN_EXIT=0