# DF-0645 — NULL deref in div_packet on re-injected divert packets (rcvif==NULL)

## Bug
`sys/netinet/ip_divert.c:186` dereferences `m->m_pkthdr.rcvif` without a
NULL guard inside the `if (incoming)` block, while line 202 (16 lines
below) correctly checks `if (m->m_pkthdr.rcvif)`.

Re-injection path: a divert daemon's `sendto` with `sin.sin_addr.s_addr
!= 0` causes `div_output()` (line 366) to call `ip_input(m)` on a
freshly-allocated mbuf whose `rcvif` is NULL (`m_gethdr` sets it NULL at
`uipc_mbuf.c:596`). When ipfw re-matches a divert rule on this packet,
`ip_divert_in -> divert_packet(m, 1) -> div_packet(m, 1, port)` runs
with `incoming=1` and `rcvif=NULL`, and line 186 panics.

## Build / Run (as root)
```sh
./build.sh
./run.sh         # configures ipfw divert rule, then triggers the panic
```
The PoC requires:
- `kldload ipfw.ko`
- `ipfw add divert 12345 ip from any to any`
- A divert socket bound to port 12345 (SYSCAP_RESTRICTEDROOT = root).

## Expected
- **Bug present:** kernel panic, `Fatal trap 12: page fault while in
  kernel mode`, faulting PC inside `div_packet+0x..`, faulting address
  near 0x0 (the NULL `rcvif`). Captured in `dfbsd-qemu/boot.log`.
- **Fixed:** PoC sendto returns cleanly, no panic, guest stays up.

## Threat model
- **Privilege:** `SYSCAP_RESTRICTEDROOT` to open a divert socket
  (enforced at `ip_divert.c:389`). Effectively root.
- **Impact:** kernel panic = full system DoS. A remote attacker can
  trigger it indirectly if a divert daemon (NAT/proxy) re-injects
  received packets with `sin_port=0` (naive "echo" pattern).