=== DF-0751 mpls_input() infinite-loop harness ===
source: sys/netproto/mpls/mpls_input.c:88-171 (label-switch loop)
depth cap (escape hatch production code lacks): 1000000 iterations

Frame A: label=0 S=0 TTL=64 (36 bytes total)

--- UNPATCHED mpls_input (shipping code: goto again WITHOUT m_adj) ---
iterations: 1000001
exit      : DEPTH CAP HIT (would loop forever)
cursor adv: off=0 (started 0)  => M BUFFER NEVER ADVANCED (same label re-read every iter)
VERDICT   : *** INFINITE LOOP CONFIRMED *** (hit 1000000-iter cap; production kernel has NO cap => hard hang)

--- PATCHED mpls_input (fix: m_adj(m, sizeof(struct mpls)) before goto again) ---
iterations: 10
exit      : m_pullup would fail (too small) -> drop
cursor adv: off=36 (started 0)
VERDICT   : loop TERMINATES cleanly (no hang). Fix is effective.

--- UNPATCHED, Frame B: label=2 S=0 (IPv6 explicit NULL, mpls_input.c:142) ---
iterations: 1000001
exit      : DEPTH CAP HIT (would loop forever)
VERDICT   : *** INFINITE LOOP CONFIRMED (case 2 twin bug) ***

--- Control: label=0 S=1 (bottom-of-stack; unpatched) ---
iterations: 1
exit      : label 0 S=1: netisr_queue(NETISR_IP) -> return
VERDICT   : terminates (S-bit path is correct)
RUN_RC=0