DF-0619 — leak exfiltration attempt (20000-iteration stress with tcpdump on lo0)
=============================================================================

Triggered sendto(fd, buf, 1, 0, &{sa_len=2, sa_family=AF_INET6}, 2) 20000x
while `tcpdump -i lo0 -w /tmp/oob.pcap ip6` was running.

Result:
  sendto returned 0 (packet emitted): 0 times
  errno 65 (EHOSTUNREACH): 20000 times
  tcpdump captured: 0 packets

Interpretation:
  The OOB read at rip6_send:743 happened on every iteration (we know because
  sendto did NOT return EINVAL). The 26 leaked bytes populated tmp.sin6_addr
  and were used as the IPv6 destination. On this guest (no IPv6 default route;
  only ::1, fe80::%vtnet0/64, ff02:: routes present), every corrupted
  destination was unroutable, so in6_selectsrc/ip6_output returned EHOSTUNREACH
  and no packet was emitted on the wire. The leak is therefore kernel-internal
  (the bytes land in a stack local that is then discarded) and not directly
  exfiltrated to userspace in default guest conditions. An attacker could
  observe the leaked bytes only by grooming the slab so the corrupted
  destination happens to be routable AND by capturing the resulting outgoing
  packet (second raw socket / tcpdump / on-path position).