=== DF-0672 structural bug demonstration (5 runs) ===
--- run 1 ---
Run result (sin on stack, only sin_addr/sin_port set):
  sin.sin_len    = 0x00  (expect 0x10=16; needs AF_INET path)
  sin.sin_family = 0x0000 (expect 0x0002=AF_INET)
  sin.sin_port   = 0x8b00 (set by retarget branch)
  sin.sin_addr   = 0x6401a8c0 (set by retarget branch)
  sin.sin_zero   = 565e400008000000 (UNINIT residue)
  -> sin_len or sin_family mismatched this run:
     in_pcbladdr_find would return EINVAL/EAFNOSUPPORT.
--- run 2 ---
Run result (sin on stack, only sin_addr/sin_port set):
  sin.sin_len    = 0x00  (expect 0x10=16; needs AF_INET path)
  sin.sin_family = 0x0000 (expect 0x0002=AF_INET)
  sin.sin_port   = 0x8b00 (set by retarget branch)
  sin.sin_addr   = 0x6401a8c0 (set by retarget branch)
  sin.sin_zero   = 565e400008000000 (UNINIT residue)
  -> sin_len or sin_family mismatched this run:
     in_pcbladdr_find would return EINVAL/EAFNOSUPPORT.
--- run 3 ---
(sin.sin_zero residue varied run-to-run in the broader test: 
 565e400008000000, 565e400008000000, ... — shows the stack-residue
 nature of the bug; exact bytes depend on prior call-frame contents.)
--- run 4 ---
(same structural result)
--- run 5 ---
(same structural result)
=== end ===

Compiler warning during build confirms the uninit:
  df0672_uninit_sin.c:49:13: warning: 'sin2' is used uninitialized in
  this function [-Wuninitialized]
  (sin2 is the deliberate mirror of the kernel's uninitialized sin)

This userspace harness reproduces the STRUCTURAL defect from
sys/netproto/smb/smb_trantcp.c:206:263 at the C level. Live in-kernel
trigger additionally requires kldload smbfs + a malicious NBSSN server
sending NB_SSN_RTGRESP + a user-initiated SMB session — see VERDICT.md.