### DF-0720 VULNERABLE build+run
if_alloc(IFT_PPP) returned 600-byte object (sizeof(struct ifnet))
sppp_attach() casts to struct sppp* (1624 bytes) and writes fields at offset [600 .. 1624)
bytes written past the 600-byte allocation into adjacent heap: 1024
RESULT: STRUCTURAL OVERFLOW CONFIRMED — sppp_attach writes ~1024 bytes past the if_alloc(IFT_PPP) object
rc=1