=== DF-0617: ng_ether_rcv_upper bridge_input UAF harness ===
Topology: ifp->if_bridge=0xcafe0000 (bridge member), bridge IFF_MONITOR set
bridge_input() IFF_MONITOR path: m_freem(m) + return NULL

--- BUGGY mode (current kernel: ng_ether.c:658 discards return value) ---
  Allocated mbuf 0x4028a0 (m_flags=0x00000002, m_len=60)
  [BUGGY] Falling through to ether_demux_oncpu with freed mbuf 0x4028a0
    ether_demux_oncpu: m->m_flags=0xdededede  m->m_len=-555819298  m->m_data=0xdededededededede
    *** UAF DETECTED: mbuf was freed (all fields poisoned to 0xde) but still dereferenced! ***
  Result: freed_count=1, uaf_detected=1

--- FIXED mode (m = bridge_input_p(ifp, m); — return value captured) ---
  Allocated mbuf 0x4029a8 (m_flags=0x00000002, m_len=60)
  Result: freed_count=1, uaf_detected=0

=== SUMMARY ===
BUGGY: UAF CONFIRMED — freed mbuf dereferenced in ether_demux_oncpu
FIXED: UAF ELIMINATED — early return before ether_demux_oncpu

Verdict: REPRODUCED — the one-line fix (m = bridge_input_p(...)) eliminates the UAF