=== BASELINE on unpatched kernel ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

net.filters_default_to_accept: 0 -> 1
--- BEFORE counters ---
00100 2 140 allow tcp established
65534 0   0 allow
65535 0   0 allow

--- running trigger ---
=== DF-0747: check_established th_flags read on non-first TCP frag ===
Bug: ip_fw3_layer4.c:184 L3HDR(tcphdr,ip)->th_flags reads ip+33
     on fragments that have no TCP header (pullup skipped at offset>0)

[Case 1] payload=24, th_flags_byte=TH_ACK(0x10) → expect MATCH established
    sent: offset=8 payload=24 flags_byte=0x10 (44 bytes)
[Case 2] payload=24, th_flags_byte=TH_SYN(0x02) → expect NOT established
    sent: offset=8 payload=24 flags_byte=0x02 (44 bytes)
[Case 3] min-size payload=8, th_flags read at ip+33 = 5-byte OOB
    sent: offset=8 payload=8 flags_byte=0x00 (28 bytes)
[Case 4] payload=14, th_flags_byte=TH_ACK(0x10) → MATCH established
    sent: offset=8 payload=14 flags_byte=0x10 (34 bytes)

DONE. Check 'ipfw3 show' rule-hit counters:
  rule 100 (allow established) should have Case 1 + Case 4 hits
  rule 200 (deny)             should have Case 2 hit
  Case 3 hit either rule depending on stale backing-store bytes

--- AFTER counters ---
00100 16 1888 allow tcp established
65534  2   88 allow
65535  0    0 allow

=== disabling ipfw3 ===
net.inet.ip.fw3.enable: 1 -> 0