# DF-0638 PoC — ng_deflate avail_in underflow OOB heap read

## Build (on guest)
```
# 1. build the netgraph7 stack (the default kernel uses old netgraph ABI-2 w/ no deflate)
for d in netgraph socket deflate; do (cd /usr/src/sys/netgraph7/$d && make obj && make); done
# 2. build the client
cd poc/DF-0638 && cc -o df0638 df0638.c
```

## Run (as root — socket creation is privileged; the bug trigger is the crafted frame)
```
./run.sh
```

## Expected (bug present)
`dmesg` shows `ng_deflate_decompress: decompression error: -3 (invalid stored block
lengths)` — proof that `inflate` consumed bytes out of bounds past the 2-byte input
(the avail_in underflow = OOB heap read). Depending on heap layout this is an info
leak (decompressed OOB bytes returned to peer) or a panic (OOB crosses an unmapped
page).

## Expected (FIXED module)
`dmesg` shows only `ng_deflate_rcvdata: error: 32` (EPIPE from the new lower-bound
guard) and NO decompression error — the short frame is rejected before `inflate`.

## How it works
`df0638.c` is a raw netgraph7 socket client (the base `ngctl` only speaks the old
ABI-2 netgraph and cannot drive netgraph7). It: opens an `AF_NETGRAPH` control
socket, names its node, `mkpeer`s a `deflate` node (`out` <-> `decomp`), sends
`NGM_DEFLATE_CONFIG {enable=1, windowBits=12}` (→ `inflateInit2`, `seqnum=0`), opens
a data socket attached to the node, and sends the 2-byte frame `0x00 0xfd`
(PROT_COMPD, 2-byte proto). With `inlen=2`, `offset` reaches 4, so
`avail_in = inlen - offset = (int)-2 → (uInt)0xFFFFFFFE`, and `inflate` reads OOB.