=== PATCHED MODULE RUN (if_gre.ko with m_pullup fix.diff applied) ===
sha256(/boot/kernel/if_gre.ko) = bf9c40021a6918470d9477f30023c2e5554eb79f5178436cf801cfd9d4571069
kern.version = DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

nm /boot/kernel/if_gre.ko | grep m_pullup => U m_pullup (undefined = external call, confirmed linked)

Setup: same gre0 (mobile) + gre1 (GRE) tunnels as baseline.

=== RUN 1 ===
[DF-0742-M] sending 24-byte IPPROTO_MOBILE (S-bit) packet
           m_len=24, msiz=12 → odst@24-27, osrc@28-31, cksum[20..31] all past m_len (OOB read)
  sent 24 bytes
[DF-0742-G] sending 20-byte IPPROTO_GRE packet
           m_len=20, gi_flags@20-21, gi_ptype@22-23 past m_len (OOB read)
  sent 20 bytes
[DF-0742] if the guest is still reachable, the live path did not panic (residue-dependent); check boot.log for signatures.
rc=0 guest=up
=== RUN 2 ===
[DF-0742-M] sending 24-byte IPPROTO_MOBILE (S-bit) packet
           m_len=24, msiz=12 → odst@24-27, osrc@28-31, cksum[20..31] all past m_len (OOB read)
  sent 24 bytes
[DF-0742-G] sending 20-byte IPPROTO_GRE packet
           m_len=20, gi_flags@20-21, gi_ptype@22-23 past m_len (OOB read)
  sent 20 bytes
[DF-0742] if the guest is still reachable, the live path did not panic (residue-dependent); check boot.log for signatures.
rc=0 guest=up
=== RUN 3 ===
[DF-0742-M] sending 24-byte IPPROTO_MOBILE (S-bit) packet
           m_len=24, msiz=12 → odst@24-27, osrc@28-31, cksum[20..31] all past m_len (OOB read)
  sent 24 bytes
[DF-0742-G] sending 20-byte IPPROTO_GRE packet
           m_len=20, gi_flags@20-21, gi_ptype@22-23 past m_len (OOB read)
  sent 20 bytes
[DF-0742] if the guest is still reachable, the live path did not panic (residue-dependent); check boot.log for signatures.
rc=0 guest=up

=== Result ===
All 3 runs: trigger exits 0, guest stays UP, NO panic in boot.log.
The m_pullup(m, sizeof(struct mobip_h)) call at line 241 drops the
24-byte packet (too short to hold the 32-byte overlay) before any
offset-20+ deref. Fix closes the bug.