=== FIXED MODULE: running PoC ===
=== DF-2575 trigger: rule=100 delay=3000ms flood=500 ===
pipe config rc=0
net.inet.ip.fw3.one_pass: 0 -> 0
add rc=0
00100    0      0 pipe 1 icmp from 127.0.0.1 to 127.0.0.1
65535 6422 743964 allow
=== starting ICMP flood into pipe 1 ===
=== pipe state before rule delete ===
00001: 500.000 Kbit/s 3000 ms  100 sl. 1 queues (1 buckets) droptail
mask: 0x00 0x00000000/0x0000 -> 0x00000000/0x0000
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 icmp       127.0.0.1/8708        127.0.0.1/8708   204    22032  0    0   0
=== DELETING rule 100 while packets are queued (kfree -> dangling dn_priv) ===
delete rc=0
=== waiting for dummynet re-injection (delay=3000ms) -> UAF ===
(sleeping 8s for pipe delay expiry + re-injection)
=== survived: no panic (patched kernel, or race window missed) ===
=== current rules ===
65535 8336 950620 allow
=== guest still up ===
 2:29PM  up 2 mins, 0 users, load averages: 0.03, 0.03, 0.00
FIX_RUN_RC=0
=== uptime ===
 2:29PM  up 2 mins, 0 users, load averages: 0.03, 0.03, 0.00
=== dmesg (check for warnings) ===
ipfw3 initialized, default to accept
(no warnings = clean)