# DF-2611 — redirect TLLA pad leak PoC

## Files

- `tap_rdr.c`     the whole harness in one binary:
                  `trigger N [nospray] [patch8]` — owns tap0 (exclusive,
                  destroy-on-close), performs all setup (address, static
                  ND entries, scoped gateway route, forwarding), optionally
                  rewrites tap0 `ifi_addrlen` to 8 via `/root/poc/kmem_addrlen`,
                  sprays the cluster cache with a per-iteration pattern,
                  injects a transit frame, captures and parses the emitted
                  ND_REDIRECT
- `kmem_addrlen.c` ifnet_array walker + validated ifi_addrlen rewriter
- `setup.sh`      historical (superseded by in-process setup)
- `build.sh`, `run.sh`, `run.log` (FULL untrimmed), `leak_sample.txt`,
  `env.txt`, `fix.diff`

## Reproduce

```
guest# sh build.sh
guest# sh run.sh
```

Expected: see manifest.json `reproduce.expected`. Bottom line: with
`if_addrlen != 6` the target-link-layer-address option leaks 1-7 bytes of
uninitialized kernel heap per redirect; with 6 (Ethernet) it leaks none.

## Caveat

QEMU provides no FireWire/EUI-64 NIC, so the non-Ethernet address length
is simulated by a privileged `/dev/kmem` rewrite of `ifi_addrlen`
(validated against three known interfaces first). Everything downstream —
option rounding, partial write, transmitted pad, checksum coverage — is
stock kernel behavior on the unmodified running kernel.