=== RUN 1: BASELINE (unpatched ng_lmi.ko, DF-0554 reproduced) ===
Test setup as root (simulating remote FR attacker; PF_NETGRAPH control sockets
are root-only in DragonFly -- the bug class is heap OOB-read/leak, not privesc):

  ngctl -f /tmp/ng_test_fix.txt   where the file contains:
    mkpeer . lmi annexA annexA
    show .
    write annexA 0x03                   # 1-byte frame
    write annexA 0x03 0x08              # 2-byte frame
    write annexA 0x03 0x08 0x00 0x7D    # 4-byte frame
    write annexA 0x03 0x08 0x00 0x7D 0x09   # 5-byte frame
    quit

Resulting dmesg output (baseline):
---- 8< ----
nglmi: unexpected Protocol ID(69)
nglmi: error at location 1
nglmi: packet data: 03
nglmi: unexpected Call Reference (0x8)
nglmi: error at location 2
nglmi: packet data: 03 08
nglmi: unexpected msg type(0x0) 
nglmi: error at location -65533             <-- SMOKING GUN: packetlen (u_short)
nglmi: packet data: 03 08                        wrapped 0 -> 0xFFFF at STEPBY(1)
                                                 (loc = m_len - packetlen = 2-65535 = -65533)
nglmi: unexpected Protocol ID(169)
nglmi: error at location 1
nglmi: packet data: 03
---- >8 ----

Note the leaked kernel heap bytes: "Protocol ID(69)" and "Protocol ID(169)"
are *data reads past the mbuf* (0x45 and 0xa9 = heap residue). The bytes
are echoed back via NGM_LMI_GET_STATUS replies (visible to attacker).

=== RUN 2: PATCHED (with fix.diff applied) ===
Same ngctl invocation, ng_lmi.ko rebuilt from patched source.

Resulting dmesg output (patched):
---- 8< ----
nglmi: too short (1)
nglmi: error at location 0
nglmi: packet data:>03
nglmi: too short (2)
nglmi: error at location 0
nglmi: packet data:>03 08
nglmi: too short (4)
nglmi: error at location 0
nglmi: packet data:>03 08 00 7d
nglmi: too short (5)
nglmi: error at location 0
nglmi: packet data:>03 08 00 7d 09
---- >8 ----

No "location -65533", no OOB reads. The fix (LMI_MIN_LENGTH check at top
of nglmi_checkdata) rejects short frames before any STEPBY can underflow.