=== DF-0705 (and DF-0704) reachability probe ===
=== guest: DragonFly 6.5-DEVELOPMENT #0  (with-src snapshot, unpatched baseline) ===
=== as root, with net.filters_default_to_accept=1 to keep SSH alive ===

[*] set net.filters_default_to_accept=1 BEFORE loading ipfw3
net.filters_default_to_accept: 0 -> 1
[*] load ipfw3.ko (no basic) -- ip_fw3_ctl_sync_ptr stays NULL
 4    1 0xffffffff82600000    49000 ipfw3.ko
---
[*] invoking IP_FW_SYNC_EDGE_START (DF-0705 panic 1: NULL edge_sock -> sobind)
[fire opcode=85 plen=0] setsockopt rc=0 errno=0 (Undefined error: 0)
[*] invoking IP_FW_SYNC_CENTRE_CONF with count=-1 (DF-0705 panic 3: huge bcopy)
[fire opcode=89 plen=4] setsockopt rc=0 errno=0 (Undefined error: 0)
[*] invoking IP_FW_SYNC_SHOW_CONF (DF-0705 panic 3 read-back path)
[fire opcode=82 plen=64] setsockopt rc=0 errno=0 (Undefined error: 0)
[+] All three returned without panic.
[+] Conclusion: ip_fw3_ctl_sync_ptr is NULL; IP_FW_SYNC_* opcodes are dead code.
RUN_EXIT=0

[*] also load ipfw3_basic.ko and retry
 4    2 0xffffffff82600000    49000 ipfw3.ko
 5    1 0xffffffff82649000    95000 ipfw3_basic.ko
---probe again---
[*] invoking IP_FW_SYNC_EDGE_START (DF-0705 panic 1: NULL edge_sock -> sobind)
[fire opcode=85 plen=0] setsockopt rc=0 errno=0 (Undefined error: 0)
[*] invoking IP_FW_SYNC_CENTRE_CONF with count=-1 (DF-0705 panic 3: huge bcopy)
[fire opcode=89 plen=4] setsockopt rc=0 errno=0 (Undefined error: 0)
[*] invoking IP_FW_SYNC_SHOW_CONF (DF-0705 panic 3 read-back path)
[fire opcode=82 plen=64] setsockopt rc=0 errno=0 (Undefined error: 0)
[+] All three returned without panic.
[+] Conclusion: ip_fw3_ctl_sync_ptr is NULL; IP_FW_SYNC_* opcodes are dead code.
RUN_EXIT=0

Status: up (no panic). Guest kept running.

CONCLUSION: Both DF-0704 and DF-0705 describe real defects in
sys/net/ipfw3_basic/ip_fw3_sync.c, but the file is unreachable from
userspace on a default kernel because no code ever assigns
`ip_fw3_ctl_sync_ptr` (it remains NULL forever). The IP_FW_SYNC_* sockopt
cases in ip_fw3_ctl() silently fall through. Verified empirically by
issuing all three "panic-trigger" opcodes via IP_FW_X setsockopt; all
returned rc=0 with no effect. Findings are correctly labeled LATENT.