DF-2565 / run.log
DF2565[mode=0]: m=0xfffff80118f8bc00 head m_len=20 DF2565: after call, caller's (possibly stale) m=0xfffff80118f8bc00 m_len=0 m_type=1 DF2565: fresh m_get -> 0xfffff80118f8be00 != the stale pointer DF2565: RESULT=split-header input drove m_pullup reallocation inside in_delayed_cksum; the caller-held pointer was not updated (use-after-free for every caller at ip_output.c:641/802, ip_mloopback) DF2565[mode=1]: m=0xfffff80118f8bc00 head m_len=40 DF2565: after call, caller's (possibly stale) m=0xfffff80118f8bc00 m_len=40 m_type=1 DF2565: fresh m_get -> 0xfffff80118f8be00 != the stale pointer DF2565: RESULT=contiguous control: no reallocation