# DF-0705 — Three independent panics in ip_fw3_sync.c

## Summary

`sys/net/ipfw3_basic/ip_fw3_sync.c` has three latent panic paths:

1. **`edge_start:248`** — `sobind(fw3_sync_ctx.edge_sock,...)` with no
   NULL check; if `edge_conf` was never called, `edge_sock` is NULL.
2. **`edge_start:262-264`** — `panic("...:error %d",error)` on
   `kthread_create` failure instead of returning the error.
3. **`show_conf:105-116`** — `int size = 3*sizeof(int) + count*LEN_SYNC_EDGE`
   with signed `count`; negative `count` makes `size` small, bypasses
   `sopt_valsize < size`, then `bcopy(...,count*LEN_SYNC_EDGE)` becomes a
   ~4 GiB write → page fault.

## How to reproduce

Cannot reproduce on a default kernel — see `VERDICT.md` and `run.log`.
Same dead-code reason as DF-0704: `ip_fw3_ctl_sync_ptr` is never set, so
the IP_FW_SYNC_* opcodes silently fall through.

```
./build.sh
ssh dfbsd 'sysctl net.filters_default_to_accept=1; kldload ipfw3.ko; kldload ipfw3_basic.ko'
ssh dfbsd 'cd /root/poc/DF-0705 && ./run.sh'
# expect: probe prints "All three returned without panic"
```

## Preconditions

- root (`IP_FW_X` requires raw IP socket).
- AND `ip_fw3_ctl_sync_ptr` must be non-NULL (never happens in default
  source).

## Impact

LATENT — currently zero. Would become root→kernel DoS once the sync
dispatch is wired up.

## Fix

`fix.diff` addresses all three:

- `edge_start` — NULL-check `fw3_sync_ctx.edge_sock` (return EINVAL);
  replace `panic()` on `kthread_create` failure with `kprintf` + return
  error.
- `show_conf` — reject negative `fw3_sync_ctx.count`; cast `size` to
  `size_t` for the sopt_valsize compare.
- `centre_conf` — validate `ioc_centre->count` is non-negative and
  bounded (≤ MAX_EDGES).