# DF-0668 PoC — ipfw3 table op OOB via unchecked ioc_table->id

## Build (as any user; runtime needs root)
```
cd findings/poc/DF-0668
./build.sh        # -> ipfw3_table_oob
```

## Run (as root — needs a raw IP socket + ipfw3 loaded)
```
./run.sh [id]     # default id=0x4000
```
`run.sh` sets `net.filters_default_to_accept=1` first so that loading ipfw3 (whose
default policy is DENY) does not cut off your ssh session.

## Expected (bug present, unfixed ipfw3_basic)
- As an **unprivileged** user: `socket(SOCK_RAW)` → `Operation not permitted` (root-only).
- As **root**:
  - `id=16384` → `setsockopt returned 0` (OOB accepted — a checked impl would EINVAL).
  - `id=0x10000000` → kernel panic:
    ```
    Fatal trap 12: page fault while in kernel mode
    Stopped at table_create_dispatch+0x45: movl $0,0x30(%rbx)
    ```

## Expected (after applying fix.diff to /usr/src/sys/net/ipfw3_basic/ip_fw3_table.c and
rebuilding/loading ipfw3_basic.ko)
- `id=16384` and `id=0x10000000` → `setsockopt returned -1 errno=22 (Invalid argument)`.
- valid `id=5` → `setsockopt returned 0` (legit tables still work).

## Notes
- Loading ipfw3 enables packet filtering with default DENY; you MUST set
  `net.filters_default_to_accept=1` before `kldload ipfw3` or you lose network access.
- Rebuilding just the module: `cd /usr/src/sys/net/ipfw3_basic && make`, then load
  `ipfw3_basic.ko` after `kldload ipfw3`.