# DF-3278 — bridge_fragment() double-free / UAF on M_PREPEND failure

## What

if_bridge.c:4386-4405: if any `M_PREPEND(m0, ..., M_NOWAIT)` fails
while re-attaching Ethernet headers to an ip_fragment() chain,
- the failed fragment m0 is freed by the M_PREPEND macro itself,
- the `else m_freem(m)` branch then frees fragment #1 for EVERY
  remaining iteration (double free), and
- the loop increment reads `m0->m_nextpkt` of freed memory (UAF read).

Preconditions: pfil hooks loaded (ipfw/pf), forwarded packet larger
than the egress member's MTU, and a transient m_gethdr(M_NOWAIT)
failure at the wrong instant.

## Reproduce (guest, as root)

```
cd /root/poc/df-3278
cc -O -o frag_flood frag_flood.c
sh run.sh                 # kldload ipfw, mtu-600 members, flood
./frag_flood 3000000 drain   # heavy variant: also pins mbuf clusters
```

## Status

NOT reproduced deterministically (allocation-failure window could not
be forced from userland); the fragment path itself was verified live:
500,050 datagrams fragmented through bridge_fragment and the cluster
pool driven to exhaustion (`objcache(mbuf cluster) exhausted`).
See VERDICT.md for the full code-path proof.