============================================================
DF-0749 — BASELINE (unpatched #0 kernel) PANIC SIGNATURE
============================================================
Captured from dfbsd-qemu/boot.log immediately after running:
    sysctl net.filters_default_to_accept=1
    kldload ipfw3 / ipfw3_basic / ipfw3_layer2
    ipfw3 flush
    ipfw3 add 1000 allow ip from any to any mac-from table 65535
    ping -c 1 127.0.0.1

Reproduced twice with identical signatures (different fault VA per run,
both ≈ 3.5 MB past the table_ctx allocation).

--- Run 1 ---
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80118b1f148
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826de167
stack pointer	        = 0x10:0xfffff8008d1fd740
frame pointer	        = 0x10:0xfffff8008d1fd760
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      check_mac_from_lookup+0x37:     movq    (%rax),%rbx
db> 

--- Run 2 (fresh vm.sh reset with-src) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xfffff80118ad0a48
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826de167
stack pointer	        = 0x10:0xfffff8008d2677d0
frame pointer	        = 0x10:0xfffff8008d2677f0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= Idle
current thread          = pri 12 
kernel: type 12 trap, code=0

CPU3 stopping CPUs: 0x00000037
 stopped
Stopped at      check_mac_from_lookup+0x37:     movq    (%rax),%rbx
db> 

============================================================
ANALYSIS
============================================================
instruction pointer 0xffffffff826de167 is in the ipfw3_layer2.ko module
range (0xffffffff826de000 + 0x11000).  Disassembly: check_mac_from_lookup+0x37
is exactly the `rnh = table_ctx->node;` load at
sys/net/ipfw3_layer2/ip_fw3_layer2.c:120, AFTER `table_ctx += cmd->arg1`
(120) where cmd->arg1=65535.  65535*56 = 3,669,960 bytes ≈ 3.5 MB past
ctx->table_ctx (32-entry array, sys/net/ipfw3_basic/ip_fw3_table.c:570).

The `movq (%rax), %rbx` is the OOB load of table_ctx->node, where
%rax holds the out-of-range address.  The supervisor read of an
unmapped page triggers page-fault vector 12 -> kernel panic.

This load fires BEFORE the `(*args)->eh != NULL` gate at line 124
(hence the "regardless of args.eh" claim in the finding), so it triggers
on every IP packet that traverses the rule, including loopback.