DF-3044 fix validation (A/B, same harness, same tests, only bootp_subr.c changed)
=============================================================================

Kernel A (baseline):  guest /usr/src/sys/vfs/nfs/bootp_subr.c sha256
  ada7d13fe5cd824dfb971384f00c04b5fd819eea82c0ab512f5dbd577bfc8ce3
  (verbatim gate in build.log: "VERBATIM GATE OK")
Kernel B (fixed):     baseline + fix.diff (3 hunks: random xid seed at :1550,
  soreceive origin capture at :809-812, source-port-67 requirement at :828-835),
  sha256 52154f24f8d0f6fd8964d8cab366e81a377c5c10c622a7b3531c293d33be0148
  (verbatim gate in build_fixed.log: "VERBATIM GATE OK", fixed hash allowed)

Test 2 -- blind predicted-XID spoof from 6.6.6.6:9999 (the headline attack)
  baseline: client DISCOVER xid_raw=0100ffff == predicted 0100ffff (MATCH);
            OFFER accepted, ACK accepted, decode adopts attacker config:
              hostname ADOPTED 'pwn3d'
              root NFS mount ADOPTED from attacker 6.6.6.6 path=6.6.6.6:/pwn3d
              swap NFS mount ADOPTED from 6.6.6.6 path=6.6.6.6:/swpwn
              default route ADOPTED via attacker 6.6.6.1 flags=0x803
            soreceive origin requested 0 time(s) -- :807 passes NULL name.
  fixed:    client 1st xid_raw=3c53bacd (karc4random) vs predicted 0100ffff:
            differ; hostname/root/route NOT adopted; "BOOTP call failed".
            => deterministic-XID prediction DEAD.

Test 21 -- sniffed XID (same-L2 attacker hears the broadcast), origin port 9999
  baseline: accepted (no origin check exists; same result as test 2).
  fixed:    "bootpc: reply not from server port 67, ignored" (verbatim fix
            message); OFFER/ACK dropped; timeout; nothing adopted.
            => arbitrary-origin acceptance DEAD.

Test 22 -- sniffed XID, origin port 67 (documented residual)
  fixed:    accepted, full config adoption.  A same-L2 attacker who sniffs
            the DISCOVER and spoofs UDP source port 67 still wins -- this is
            the documented netboot threat model (RFC 2131 sec 7, no RFC 3118
            auth); the fix removes the *deterministic XID* and the *any
            origin/port* acceptance, not the on-link sniffer.

Test 4 -- predicted-XID ACK carrying TAG_SUBNETMASK len 3 (panic path)
  baseline: panic: bootpc: subnet mask len is 3
            bootpc_init() at bootpc_init+0xce4 <- sysctl_df_test <-
            sysctl_root <- userland_sysctl <- sys___sysctl     (panic.txt)
  fixed:    NO panic; spoof ignored on xid+port, "DHCP timeout for interface
            vtnet0", "BOOTP call failed", test returns; guest stays up
            (run.fixed.log, tail).
            => remotely-triggerable boot-time crash via blind spoof GONE.

Verdict: fix.diff reproduces none of the baseline bad behaviors it targets
(random XID + server-port origin check); residual same-L2 sniffer with
spoofed port 67 is inherent to unauthenticated BOOTP/DHCP and is documented.