DF-3278 attempt logs (stock kernel #0, ipfw loaded).

1) Fragment-path verification (50 frames):

    $ netstat -s -p ip | grep -i "output datagrams frag"
    50 output datagrams fragmented
    $ ipfw show | head -1
    00100 1404 573966 allow ip from any to any     # hooks active

2) Heavy flood (6 x 500000 frames):

    $ netstat -s -p ip | grep -iE "bad header|fragmented"
    1000070 bad header checksums          # unchanged by the flood
    500050 output datagrams fragmented    # every frame fragmented
    8/146632 mbufs in use (current/max)   # idle snapshot

3) Cluster-exhaustion runs (./frag_flood 3000000 drain:
   8 UDP loopback drainers, SO_RCVBUF 2MB, kern.ipc.maxsockbuf=8MB):

    Serial console:
    Warning: objcache(mbuf cluster) exhausted on cpu1!
    Warning: objcache(mbuf cluster) exhausted on cpu2!
    Warning: objcache(mbuf cluster) exhausted on cpu3!
    Warning: objcache(mbuf cluster) exhausted on cpu4!
    Warning: objcache(mbuf cluster) exhausted on cpu5!

    Result: guest wedged (mbuf starvation from the drainers; ssh
    dead; no kernel panic, no double-free observed).  Two independent
    drain+flood attempts, same outcome.

Bottom line: the vulnerable function processed >500k fragment chains
under real allocation pressure, but the specific M_PREPEND failure
instant inside the re-header loop never fired -> not_reproduced.