### DF-0631 ipfw3 state->stub UAF after rule deletion ###
debug.use_weird_array (default): 0
net.link.ether.ipfw: 0 -> 1
udppkt: sent 2000 UDP 10.0.2.15:11111 -> 10.0.2.2:1
STATE_AFTER_CREATE (rulenum=00200, ptr valid):
00200 5 udp 10.0.2.15:11111 10.0.2.2:1 i 29
--- DELETE_RULE_200 with use_weird_array=0 (default: freed slab keeps stale VALID data) ---
STATE_AFTER_DELETE_weird=0 (rulenum still 00200 = SILENT UAF, stale valid data):
00200 5 udp 10.0.2.15:11111 10.0.2.2:1 i 29
--- arm slab poisoning debug.use_weird_array=1, recreate+redelete ---
debug.use_weird_array: 0 -> 1
udppkt: sent 2000 UDP 10.0.2.15:11111 -> 10.0.2.2:1
STATE_AFTER_CREATE_201:
00201 5 udp 10.0.2.15:11111 10.0.2.2:1 i 29
STATE_AFTER_DELETE_201_weird=1 (rulenum -> 49374=0xC0DE = POISONED freed mem = DANGLING STUB PROVEN):
49374 5 udp 10.0.2.15:11111 10.0.2.2:1 i 29
DF0631_DEMO_COMPLETE