=== DF-0536 BASELINE (pristine shipped v4 ng_socket.ko) — run as maxx (uid 1001) ===
[*] DF-0536: unprivileged AF_NETGRAPH data-socket heap over-read
[*] uid=1001 euid=1001
[+] data socket created (fd=3) - NO privilege required
[*] calling connect() with sg_len=5, payload 3x 'A' (no NUL)
[*] kernel should strncpy() past the 5-byte allocation -> OOB read
[*] connect returned -1, errno=6 (Device not configured)
[+] connect returned error (expected) BUT the strncpy
    OOB-read primitive already fired before the error.
[+] DF-0536 OOB-read path exercised.
RUN_EXIT=0
[guest stayed up; OOB read bounded to 511 bytes stayed in mapped heap -> no panic]

Source trace proving the OOB read:
  ng_connect_data (sys/netgraph/socket/ng_socket.c:657-658) ->
    ng_path2node(NULL, sap->sg_data, ...)            [NO NUL-termination check]
      sys/netgraph/netgraph/ng_base.c:1093:
        strncpy(fullpath, address, sizeof(fullpath) - 1);   /* scans past sa_len alloc */
  ng_bind has the guard at sys/netgraph/socket/ng_socket.c:718
    (sap->sg_len < 3 || sap->sg_data[sap->sg_len - 3] != '\0')  -- ng_connect_data omits it.

8 000-iteration spray (dfbsd-maxx) did not panic: the 511-byte bounded read stays within
contiguous slab pages, so the demonstrable impact is a silent heap over-read, not a
reliable DoS on this layout.