# DF-0631 PoC — ipfw3 state->stub UAF after rule deletion

## Build (on guest, as maxx)
```
cd poc/DF-0631 && cc -o udppkt udppkt.c
```

## Run (as root — privileged setup models the admin-configured firewall; the
## trigger packet itself is unprivileged)
```
./run.sh
```
`run.sh` performs: `sysctl net.filters_default_to_accept=1` (avoid lockout) →
`kldload ipfw3 ipfw3_basic` → `sysctl net.link.ether.ipfw=1` → add `check-state`
+ `allow udp ... keep-state` → (maxx) `udppkt` to create a state → `ipfw3 delete`
the rule → `sysctl debug.use_weird_array=1` + recreate/redelete → observe
`ipfw3 state show`.

## Expected (bug present)
After deleting the keep-state rule, `ipfw3 state show` shows the orphaned state with
a **corrupted rulenum of `49374`** (= `0xC0DE`, the low 16 bits of the slab poison
`0xdeadc0de`): the state's `stub` now points at freed, poisoned kernel memory.
(With the default `debug.use_weird_array=0`, the rulenum reads back the stale valid
`00200` — a *silent* UAF.)

## Expected (FIXED kernel/module)
After delete, `ipfw3 state show` is **empty** — the state referencing the deleted
rule is swept.

## Notes
- `net.filters_default_to_accept=1` MUST be set before loading ipfw3 or the
  default-deny policy (with `net.link.ether.ipfw=1`) locks out ssh.
- The state table is per-CPU; the `udppkt` burst spreads across CPUs so the
  state-creating and state-matching packets land on the same CPU.