panic: bad TCP data offset 16 (tlen 20)
cpuid = 0
Trace beginning at frame 0xfffff8008d1f88f0
tcp_input() at tcp_input+0x11e1 0xffffffff807ba021
tcp_input() at tcp_input+0x11e1 0xffffffff807ba021
tcp6_input() at tcp6_input+0x64 0xffffffff807bca44
transport6_processing_handler() at transport6_processing_handler+0x4c 0xffffffff807da21c
netmsg_service_loop() at netmsg_service_loop+0xe9 0xffffffff807464a9
Debugger("panic")

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

# Trigger: /root/tcp_off6  (DF-3293 PoC A)
#   single IPv6/TCP packet, th_off=4 (16 < sizeof(struct tcphdr)),
#   dst fd00::16 (tap0), dport 9999 (closed - panic is pre-pcb-lookup)
#   injected via tap(4) write -> ether_input -> NETISR_IPV6 -> tcp6_input -> tcp_input
# Guest: DragonFly 6.5-DEVELOPMENT #0 X86_64_GENERIC (INVARIANTS), vm.sh log