Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0x28
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff8074946d
stack pointer	        = 0x10:0xfffff8008d1f8960
frame pointer	        = 0x10:0xfffff8008d1f8980
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12
trap number		= 12
panic: page fault
cpuid = 0
boot() called on cpu#0
Uptime: 50s
Physical memory: 4060 MB
Dumping 628 MB: 613 597 581 565 549 533 517 501 485 469 453 437 421 405 389 373 357 341 325 309 293 277 261 245 229 213 197 181 165 149 133 117 101 85 69 53 37 21 5
Dump complete

---

Fault VA = 0x28 = byte offset of `rnh_walktree` within `struct
radix_node_head`, confirming the panic is `head->rnh_walktree` with
`head == NULL` (NULL+offset deref), i.e. exactly the `rn_flush(NULL)`
sink called from `sys/net/ipfw3_basic/ip_fw3_table.c:130`
(table_delete_dispatch) on a table whose `table_ctx->node` was never
initialized by `IP_FW_TABLE_CREATE`.

Trigger:
  setsockopt(socket(AF_INET, SOCK_RAW, IPPROTO_RAW),
             IPPROTO_IP, IP_FW_X,
             {x_header.opcode=IP_FW_TABLE_DELETE=74, ioc_table.id=0},
             valsize=48)
after `kldload ipfw3; kldload ipfw3_basic` with no tables created.

Threat model: root-only (SOCK_RAW). Default GENERIC kernel,
INVARIANTS ON, no SMAP/SMEP/KASLR. Reproduces deterministically.