### DF-3045 baseline kernel, test 3 (sdl_alen=17) and test 5 (hexncpy call-form canaries): console traces captured verbatim ###

dfrig12: === test 3 begin ===
dfrig12: DF3045: selection at :1046-1053 ACCEPTED IFT_ETHER sdl_alen=17 (>16, never checked)
dfrig12: DF3045: call.hlen=17 (call.hlen=sdl_alen at :1192)
DF3045: call.chaddr[0..23] = 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 00 00 00 00 00 00 00
DF3045: chaddr member is 16 bytes; chaddr[16] (== call.sname[0]) = 50, expected MAC byte 0x50 -> bcopy at :1197 overran chaddr[16] by 1 byte(s)
dfrig12: DF3045: bcopy overran chaddr[16] by 1 byte(s): call.sname[0]=50 == MAC[16]=50
Sending DHCP Discover packet from interface fak0 (40:41:42:43:44:45:46:47:48:49:4a:4b:4c:4d:4e:4f:50)
dfrig12: client broadcasts query #1 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
DF3045: reply matcher bcmp len=17: chaddr member is 16 bytes -> reads 1 byte(s) past chaddr[15] (in-struct, into sname/file/vend)
Received DHCP Offer packet on fak0 from 6.6.6.6 (accepted) (no root path)
DHCP timeout for interface fak0
dfrig12: DF3045: matcher bcmp len=17 (1 byte(s) past chaddr[15] read on BOTH sides), bootpc_call error=60
dfrig12: === test 3 end ===
dfrig12: === test 3 begin ===
dfrig12: DF3045: selection at :1046-1053 ACCEPTED IFT_ETHER sdl_alen=17 (>16, never checked)
dfrig12: DF3045: call.hlen=17 (call.hlen=sdl_alen at :1192)
DF3045: call.chaddr[0..23] = 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 00 00 00 00 00 00 00
DF3045: chaddr member is 16 bytes; chaddr[16] (== call.sname[0]) = 50, expected MAC byte 0x50 -> bcopy at :1197 overran chaddr[16] by 1 byte(s)
dfrig12: DF3045: bcopy overran chaddr[16] by 1 byte(s): call.sname[0]=50 == MAC[16]=50
Sending DHCP Discover packet from interface fak0 (40:41:42:43:44:45:46:47:48:49:4a:4b:4c:4d:4e:4f:50)
dfrig12: client broadcasts query #1 xid_raw=0100ffff msgtype=1 (any same-L2 host hears it)
dfrig12: ATTACKER injects OFFER xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
DF3045: reply matcher bcmp len=17: chaddr member is 16 bytes -> reads 1 byte(s) past chaddr[15] (in-struct, into sname/file/vend)
Received DHCP Offer packet on fak0 from 6.6.6.6 (accepted) (no root path)
Sending DHCP Request packet from interface fak0 (40:41:42:43:44:45:46:47:48:49:4a:4b:4c:4d:4e:4f:50)
dfrig12: client broadcasts query #2 xid_raw=0100ffff msgtype=3 (any same-L2 host hears it)
dfrig12: ATTACKER injects ACK xid_raw=0100ffff origin=6.6.6.6:9999 yiaddr=6.6.6.66 siaddr=6.6.6.6
DF3045: reply matcher bcmp len=17: chaddr member is 16 bytes -> reads 1 byte(s) past chaddr[15] (in-struct, into sname/file/vend)
Received DHCP Ack packet on fak0 from 6.6.6.6 (accepted) (got root path)
dfrig12: DF3045: matcher bcmp len=17 (1 byte(s) past chaddr[15] read on BOTH sides), bootpc_call error=0
dfrig12: === test 3 end ===

dfrig12: === test 5 begin ===
dfrig12: DF3045 T5a: as-shipped form alen=22: HEX_NCPYLEN=66 into 64-byte buffer: 0 byte(s) past end (offsets -1..-1), pre intact=0
dfrig12: DF3045 T5b: alen=106: footprint=318: 0 smashed bytes (offsets -1..-1), next intact post[0]=0xbb (scaling: alen=255 -> 701 bytes past end)
dfrig12: DF3045 T5c: fixed form (outlen=sizeof(hexstr)=64): 0 smashed byte(s) past end (expected 0), pre intact=1
dfrig12: === test 5 end ===
dfrig12: === test 5 begin ===
dfrig12: DF3045 T5a: as-shipped form alen=22: HEX_NCPYLEN=66 into 64-byte buffer: 2 byte(s) past end (offsets 0..1), pre intact=1
dfrig12: DF3045 T5b: alen=106: footprint=318: 254 smashed bytes (offsets 0..253), next intact post[254]=0xbb (scaling: alen=255 -> 701 bytes past end)
dfrig12: DF3045 T5c: fixed form (outlen=sizeof(hexstr)=64): 0 smashed byte(s) past end (expected 0), pre intact=1
dfrig12: === test 5 end ===