=== RUN 1 (baseline, stock pf.ko): ./trigger_changeaddr  [ioctl variant] ===
setup: 1 active NAT rule(s), active ticket 1
trigger: DIOCCHANGEADDR PF_CHANGE_REMOVE last pool addr...
[ssh session died; guest down; serial console:]
Fatal user address access from kernel mode from trigger_changead at ffffffff82607d31
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x0
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82607d31
current process		= 1090 (trigger_changeaddr)
CPU1 stopping CPUs: 0x0000003d
Stopped at      pf_addrcpy+0x11:        movl    (%rsi),%eax
db>

=== RUN 2 (baseline, stock pf.ko): ./trigger_changeaddr datapath enable ===
setup: 1 active NAT rule(s), active ticket 1
trigger: pool emptied (pool->cur == NULL); sending packet
[ssh died; serial tail:]
Stopped at      pf_map_addr+0x76:       movzbl  0x28(%rbx),%ecx
db>

=== RUN 3 (PATCHED pf.ko, fix.diff applied in /usr/src, module rebuilt+loaded) ===
$ ./fixcheck
setup: 1 NAT rule(s), ticket 1, pool has 2 addrs
remove #1 (not last): OK, pool still has 1 addr
remove #2 (last): Device busy (expected EBUSY, no panic)
fixcheck_rc=0
$ ./trigger_changeaddr
setup: 1 active NAT rule(s), active ticket 2
trigger: DIOCCHANGEADDR PF_CHANGE_REMOVE last pool addr...
trigger: ioctl returned Device busy (no panic?)
ioctl_rc=0
$ ./trigger_changeaddr datapath enable
[removal refused with EBUSY; however the unconstrained nat rule + DIOCSTART
 then NAT-translated the ssh session's own packets -> session black-holed;
 kernel stayed alive (serial login prompt responsive). Harness artifact of
 leaving a wildcard NAT rule enabled; not the bug under test.]