DF-0753 fix validation log
=========================

Baseline (unpatched mpls.ko, sha256 87133dff7b769f19df354852075518321eb503e9bb9a5e424fbdf84dfb433bca):
  - Built from clean /usr/src/sys/netproto/mpls with DF-0751 Makefile
  - kldload mpls.ko: LOAD=0
  - Live trigger (3x MPLS frame via bpf BIOCSFEEDBACK on vtnet0): no panic
    (14-byte ether headroom prevents M_PREPEND realloc — control scenario)
  - Harness scenario A2 (PUSH no-headroom + if_output err): DOUBLE-FREE CONFIRMED
  - Harness scenario B  (SWAP fragmented → m_pullup): DOUBLE-FREE + UAF CONFIRMED

Patched (mpls_output takes struct mbuf **mp, sha256 72fb38102de44c5979d3a3ba02a6c9047253a6bf9328ffbd272a48f32cf4141b):
  - git apply fix.diff: APPLY=0 (clean)
  - Module rebuild (cc 8.3, -Werror): BUILD=0
  - Cold boot + kldload mpls.ko: LOAD=0
  - Live trigger (3x): no panic, no regression, guest stays up
  - Harness scenario A  (PUSH no-headroom, success): PASS (0 double-free, 0 uaf)
  - Harness scenario A2 (PUSH no-headroom, if_output err): PASS (0 double-free, 0 uaf)
  - Harness scenario B  (SWAP fragmented → m_pullup): PASS (0 double-free, 0 uaf)

Contrast: the stale-pointer / double-free / UAF primitives present in the
unpatched code are structurally eliminated by the fix.

Note: kldunload mpls crashes the guest (pffindtype page fault — MPLS KLD
domain-teardown bug, separate from DF-0753). Fix validation used cold boot.