=== BASELINE on unpatched kernel ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

net.filters_default_to_accept: 0 -> 1
--- BEFORE counters ---
00100 2 140 allow tcp established
65534 0   0 allow
65535 0   0 allow

--- running trigger ---
=== DF-0747: check_established th_flags read on non-first TCP frag ===
Bug: ip_fw3_layer4.c:184 L3HDR(tcphdr,ip)->th_flags reads ip+33
     on fragments that have no TCP header (pullup skipped at offset>0)

[Case 1] payload=24, th_flags_byte=TH_ACK(0x10) → expect MATCH established
    sent: offset=8 payload=24 flags_byte=0x10 (44 bytes)
[Case 2] payload=24, th_flags_byte=TH_SYN(0x02) → expect NOT established
    sent: offset=8 payload=24 flags_byte=0x02 (44 bytes)
[Case 3] min-size payload=8, th_flags read at ip+33 = 5-byte OOB
    sent: offset=8 payload=8 flags_byte=0x00 (28 bytes)
[Case 4] payload=14, th_flags_byte=TH_ACK(0x10) → MATCH established
    sent: offset=8 payload=14 flags_byte=0x10 (34 bytes)

--- AFTER counters ---
00100 16 1888 allow tcp established
65534  2   88 allow
65535  0    0 allow

=== disabling ipfw3 ===
net.inet.ip.fw3.enable: 1 -> 0

=== KEY RESULT ===
Rule 65534 delta = 2 pkts / 88 bytes = exactly Case 2 (SYN@byte13, 44B x 2 [IN+OUT])
This proves check_established read the attacker-controlled byte 0x02 (SYN) at
fragment position 13 and classified the fragment as non-established.