=== DF-0535 — getsockaddr minimum-length guard probe (as root, pristine v4 module) ===
 offsetof(struct sockaddr, sa_data[0]) = 2 ; sizeof(struct sockaddr) = 16

 sg_len=0  sendmsg rc=-1 errno=33 (Numerical argument out of domain)   [EDOM, rejected]
 sg_len=1  sendmsg rc=-1 errno=33 (Numerical argument out of domain)   [EDOM, rejected]
 sg_len=2  sendmsg rc=1   errno=0   (success: len=0, no underflow)
 sg_len=3  sendmsg rc=-1 errno=2   (No such file or directory)         [len=1, path lookup]
 sg_len=4  sendmsg rc=-1 errno=2   (No such file or directory)

The finding claims sg_len=0 and sg_len=1 panic the kernel (bcopy of (size_t)-1).
Both are rejected with EDOM by getsockaddr() at sys/kern/uipc_syscalls.c:1521-1522
(len < offsetof(struct sockaddr, sa_data[0]) == 2) BEFORE ngc_send runs, so the
`len = sap->sg_len - 2` underflow never executes. FALSE POSITIVE.