=== DF-0534 BASELINE (pristine shipped v4 ng_socket.ko) — run as root ===
[*] DF-0534: ngc_send heap OOB read (control socket, root-only)
[*] uid=0 euid=0
[+] control socket created fd=3 (required SYSCAP_RESTRICTEDROOT)
[*] sending 1-byte ng_mesg (version=8) -> kmalloc(2), then kernel
[*] derefs header.typecookie @off16 / cmd @off20 -> OOB read
[*] sendmsg returned -1, errno=2 (No such file or directory)
RUN_EXIT=0
[undersized 1-byte control message ACCEPTED by ngc_send and passed to ng_send_msg;
 in this v4 call the path "x" did not resolve so CALL_MSG_HANDLER was not reached,
 but the under-sized buffer flowed into code that dereferences header fields.
 In the CITED netgraph7 code (ng_socket.c:276-291) the typecookie/cmd OOB reads
 are INLINE and UNCONDITIONAL, before the path lookup at :310.]

=== DF-0534 FIXED (v4 ng_socket.ko + minimum-size check) — run as root ===
[*] sending 1-byte ng_mesg (version=8) -> kmalloc(2), then kernel
[*] sendmsg returned -1, errno=22 (Invalid argument)
RUN_EXIT=0

CONTRAST:
  baseline (pristine): errno=2  (ENOENT) - undersized msg accepted, flowed to handler path
  fixed    (+check):   errno=22 (EINVAL) - ngc_send rejects len < sizeof(ng_msghdr) first
=> fix closes the path.