DF-0743 harness: greip / mobip_h overlay vs ip_hl-aware read
Replicates the kernel struct-overlay derefs at:
  sys/netinet/ip_gre.c:133 (gip = mtod(m, struct greip *))
  sys/netinet/ip_gre.c:151 (flags = ntohs(gip->gi_flags))
  sys/netinet/ip_gre.c:164 (ntohs(gip->gi_ptype))
  sys/netinet/ip_gre.c:210 (mip = mtod(m, struct mobip_h *))
  sys/netinet/ip_gre.c:223,225,229,230,232

=== GRE path (gre_input2)  outer ip_hl=7 (IP options present) ===
    IP-option bytes @20..27: aa aa bb bb 0c 04 00 00
    real GRE header @28..31: flags=0x0000 ptype=0x0800
    gi_flags               overlay=0xaaaa  correct=0x0000  *** MISMATCH (misparse) ***
    gi_ptype               overlay=0xbbbb  correct=0x0800  *** MISMATCH (misparse) ***
    kernel overlay decision: ptype 0xbbbb != ETHERTYPE_IP -> DROP
    correct      decision: ptype 0x0800 == ETHERTYPE_IP -> ACCEPT/decapsulate
    *** DECISION DIVERGES: misparse changes accept/drop ***

=== MOBILE path (gre_mobile_input)  outer ip_hl=7 ===
    IP-option bytes @20..27: cc cc 00 00 dd dd dd dd
    real mobile hdr  @28..39: proto=0x0080 hcrc=0xeb7a odst=0x0a000002 osrc=0x0a000003
    mh.proto               overlay=0xcccc  correct=0x0080  *** MISMATCH (misparse) ***
    mh.odst                overlay=0xdddddddd  correct=0x0200000a  *** MISMATCH (misparse) ***
    mh.osrc                overlay=0x7aeb8000  correct=0x0300000a  *** MISMATCH (misparse) ***
    kernel overlay S-bit: proto 0xcccc -> S=1 -> msiz=12
    correct      S-bit: proto 0x0080 -> S=1 -> msiz=12
    kernel overlay gre_in_cksum(&mip->mh) = 0x7c8b -> FAIL -> m_freem DROP
    correct      gre_in_cksum(mh_real)    = 0x0000 -> PASS
    *** CHECKSUM DECISION DIVERGES ***

VERDICT: MISPARSE PROVEN (vulnerable) — overlay reads IP-option bytes
         instead of the real GRE/mobile header when ip_hl > 5.
EXIT=0