=== RUN 2 (confirmation of baseline) ===

--- BEFORE ---
00100 2 132 allow tcp established
65534 0   0 allow
65535 0   0 allow

--- trigger (same 4 cases) ---
[Case 1] payload=24, th_flags_byte=TH_ACK(0x10) → expect MATCH established
[Case 2] payload=24, th_flags_byte=TH_SYN(0x02) → expect NOT established
[Case 3] min-size payload=8, th_flags read at ip+33 = 5-byte OOB
[Case 4] payload=14, th_flags_byte=TH_ACK(0x10) → MATCH established

--- AFTER ---
00100 16 1864 allow tcp established
65534  2   88 allow
65535  0    0 allow

Rule 65534 delta = 2 pkts / 88 bytes (consistent with Run 1)

=== RUN 3 (positional confirmation: byte 13 is the exact read position) ===

Test2 sends 3 fragments varying the byte at position 13:
  1. ACK(0x10)@byte13   → MATCH established
  2. SYN(0x02)@byte13   → NOT match
  3. 0xAA@byte13        → (0xAA & 0x16) = 0x02 = SYN → NOT match

--- BEFORE test2 ---
00100 2 132 allow tcp established
65534 0   0 allow
65535 0   0 allow

--- AFTER test2 ---
00100 10 808 allow tcp established
65534  4 176 allow
65535  0    0 allow

Rule 65534 delta = 4 pkts / 176 bytes = exactly fragments 2+3 (44B x 2 x 2 dirs)
Confirms byte 13 is the exact position read as th_flags.