panic: bad TCP data offset 60 (tlen 20)
cpuid = 1
Trace beginning at frame 0xfffff8008d1fd850
tcp_input() at tcp_input+0x11e1 0xffffffff807ba021
tcp_input() at tcp_input+0x11e1 0xffffffff807ba021
transport_processing_oncpu.isra.7() at transport_processing_oncpu.isra.7+0x6b 0xffffffff807aee6b
ip_input() at ip_input+0x71f 0xffffffff807b10ef
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9
Debugger("panic")

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Trigger: /root/tcp_off4_gre  (DF-3293 PoC B)
#   IPv4 packet, outer: IP(src=10.99.0.2,dst=10.99.0.1,proto=47 GRE) ->
#   GRE(ptype=0x0800) -> inner IP(src=10.99.0.2,dst=10.99.0.1,proto=6,
#   ip_len=40) -> inner TCP(th_off=15 => claims 60-byte header, tlen=20)
#   injected via tap(4) write -> ether_input -> ip_lengthcheck(OUTER, sets
#   M_LENCHECKED) -> ip_input -> gre_input -> gre_input2 decaps, clears
#   M_HASH only (ip_gre.c:192) -> netisr_queue(NETISR_IP) -> ip_input ->
#   ip_hashfn sees stale M_LENCHECKED, SKIPS ip_lengthcheck for the INNER
#   header -> tcp_input -> KASSERT(off <= tlen) fires.
# Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS), vm.sh log