=== FIXED MODULE TEST ===
kernel: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
module: SHA256 (/boot/kernel/ipfw3_layer4.ko) = aec57daea3003e1342c79e336fc0f7d7bdb3496620092f67da62c0d5ef66e001

net.filters_default_to_accept: 0 -> 1
 4    2 0xffffffff82600000    49000 ipfw3.ko
 5    2 0xffffffff82649000    95000 ipfw3_basic.ko
 6    1 0xffffffff826de000     1000 ipfw3_layer4.ko
--- BEFORE counters ---
00100 2 140 allow tcp established
65534 0   0 allow
65535 0   0 allow

--- running trigger ---
=== DF-0747: check_established th_flags read on non-first TCP frag ===
Bug: ip_fw3_layer4.c:184 L3HDR(tcphdr,ip)->th_flags reads ip+33
     on fragments that have no TCP header (pullup skipped at offset>0)

[Case 1] payload=24, th_flags_byte=TH_ACK(0x10) → expect MATCH established
    sent: offset=8 payload=24 flags_byte=0x10 (44 bytes)
[Case 2] payload=24, th_flags_byte=TH_SYN(0x02) → expect NOT established
    sent: offset=8 payload=24 flags_byte=0x02 (44 bytes)
[Case 3] min-size payload=8, th_flags read at ip+33 = 5-byte OOB
    sent: offset=8 payload=8 flags_byte=0x00 (28 bytes)
[Case 4] payload=14, th_flags_byte=TH_ACK(0x10) → MATCH established
    sent: offset=8 payload=14 flags_byte=0x10 (34 bytes)

DONE. Check 'ipfw3 show' rule-hit counters:
  rule 100 (allow established) should have Case 1 + Case 4 hits
  rule 200 (deny)             should have Case 2 hit
  Case 3 hit either rule depending on stale backing-store bytes

--- AFTER counters ---
00100 18 1976 allow tcp established
65534  0    0 allow
65535  0    0 allow

=== disabling ipfw3 ===
net.inet.ip.fw3.enable: 1 -> 0