=== BASELINE #0 (unpatched ipfw3_nat.ko) ===
$ /root/poc0573/trigger 17
[*] DF-0573: sending IP_FW_NAT_ADD with id=17 (NAT_ID_MAX=16)
[*] kernel will index nats[id-1] = nats[16] with no bounds check
[*] setsockopt(IP_FW_X, IP_FW_NAT_ADD, id=17, count=1)
[+] setsockopt returned 0 (errno=0: Undefined error: 0)
[!] setsockopt succeeded -> OOB array access in kernel
[!] on INVARIANTS kernels: panic likely
[!] on production kernels: type-confused cfg_nat written
EXIT=0
# guest wedges ~10s later:
spin_lock_ex: _callout_gettoc, indefinite wait (1 secs)!
spin_lock_ex: softclock_handler, indefinite wait (1 secs)!
spin_lock_ex: _callout_gettoc, indefinite wait (2 secs)!
... (continues, kernel hangs)

=== PATCHED (rebuilt ipfw3_nat.ko) ===
$ /root/poc0573/trigger 17
[*] DF-0573: sending IP_FW_NAT_ADD with id=17 (NAT_ID_MAX=16)
[*] kernel will index nats[id-1] = nats[16] with no bounds check
[*] setsockopt(IP_FW_X, IP_FW_NAT_ADD, id=17, count=1)
[+] setsockopt returned -1 (errno=22: Invalid argument)
EXIT=2
$ uptime
11:39PM  up 34 secs, 0 users, load averages: 0.15, 0.04, 0.01

$ /root/poc0573/trigger 0
[+] setsockopt returned -1 (errno=22: Invalid argument)

$ /root/poc0573/trigger -1
[+] setsockopt returned -1 (errno=22: Invalid argument)

$ /root/poc0573/trigger 5
[!] setsockopt succeeded -> OOB array access in kernel  (note: id=5 is in valid range; PoC message is generic)
$ ipfw3 nat 5 show config
ipfw3 nat 5 config ip 10.0.2.15    <-- NAT created correctly

$ /root/poc0573/trigger 16
[!] setsockopt succeeded ...
$ ipfw3 nat 16 show config
ipfw3 nat 16 config ip 10.0.2.15