# DF-2340 — fix_run.log: PATCHED /usr/src (fix.diff applied) + harness built
# WITH_DF2340_FIXED=1 (replays the patched allocation order; the kue_setmulti()
# it calls is the verbatim static function compiled out of the PATCHED tree).
# Two runs captured; both survive, both unload clean, guest stays up.

## Run 1 (fixed) — command (host):

    dfbsd-qemu/vm.sh run_root 'kldload /root/df2340/kue_poc.ko; echo KLDLOAD_RC=$?; kldunload kue_poc && echo UNLOAD_OK'

ssh stdout:

```
KLDLOAD_RC=0
UNLOAD_OK
```

serial console:

```
kue_poc: PATCHED order: descriptor first (KUE_MCFILTCNT=2), then kmalloc(12) -> sc_mcfilters=0xfffff8008d5e16b0
kue_poc: descriptor arrived: KUE_MCFILTCNT(sc)=2 (was 0 at allocation time in the stock driver)
kue_poc: entering VERBATIM kue_setmulti() (if_kue.c:355-398): memcpy(KUE_MCFILT(sc,0)=0xfffff8008d5e16b0, ..., 6)
kue_poc: SURVIVED kue_setmulti() — buffer was properly sized (fix in effect?)
```

## Run 2 (fixed, re-capture) — command (host):

    dfbsd-qemu/vm.sh run_root '{ ...; kldload /root/df2340/kue_poc.ko; echo KLDLOAD_RC=$?; kldunload kue_poc && echo UNLOAD_OK; ... }'

ssh stdout (/tmp capture):

```
=== DF-2340 fix validation: patched /usr/src (fix.diff applied), harness WITH_DF2340_FIXED=1 ===
--- load patched production if_kue.ko:
KUE_DRIVER_LOAD_OK
KUE_DRIVER_UNLOAD_OK
--- load fixed-order harness (verbatim kue_setmulti from PATCHED tree):
KLDLOAD_RC=0
UNLOAD_OK
```

serial console (note the different — real heap — buffer address across runs):

```
kue_poc: PATCHED order: descriptor first (KUE_MCFILTCNT=2), then kmalloc(12) -> sc_mcfilters=0xfffff8008d7026d0
kue_poc: descriptor arrived: KUE_MCFILTCNT(sc)=2 (was 0 at allocation time in the stock driver)
kue_poc: entering VERBATIM kue_setmulti() (if_kue.c:355-398): memcpy(KUE_MCFILT(sc,0)=0xfffff8008d7026d0, ..., 6)
kue_poc: SURVIVED kue_setmulti() — buffer was properly sized (fix in effect?)
```

Guest remained up after both runs (`vm.sh status` => up). Identical device data
(same 16-byte GET_ETHER_DESCRIPTOR reply with kue_mcastfilt=0x0002, same
01:00:5e:00:00:01 membership) as the baseline runs that panicked.