=== VARIANT A: UAF read (dst IP 10.0.0.1, no valid CARP body) ===
carpstats before A:
carp:|	0 packets received (IPv4)|	0 packets received (IPv6)|		0 packets discarded for wrong TTL|		0 packets shorter than header|		0 discarded for bad checksums|		0 discarded packets with a bad version|		0 discarded because packet too short|		0 discarded for bad authentication|		0 discarded for bad vhid|		0 discarded because of a bad address list|	4 packets sent (IPv4)|	0 packets sent (IPv6)|		0 send failed due to mbuf memory error|
M_CARP in-use before destroy: 4 1.83K
/dev/tap0: wrote 74 bytes (variant A1)
ip reassembly queues (netstat -s -p ip, fragments): 	1 fragment received
	0 fragments dropped (dup or out of space)
>>> destroying carp0 NOW
ifconfig carp0 after destroy: ifconfig: interface carp0 does not exist
M_CARP in-use after destroy: 0 0
/dev/tap0: wrote 42 bytes (variant A2)
carpstats after A (post-destroy frag2):
carp:|	1 packet received (IPv4)|	0 packets received (IPv6)|		0 packets discarded for wrong TTL|		0 packets shorter than header|		0 discarded for bad checksums|		0 discarded packets with a bad version|		0 discarded because packet too short|		0 discarded for bad authentication|		0 discarded for bad vhid|		0 discarded because of a bad address list|	4 packets sent (IPv4)|	0 packets sent (IPv6)|		0 send failed due to mbuf memory error|
--- dmesg tail (carp) ---
carp0: MAC address: 00:00:5e:00:01:00
carp_proto_input: packet received on stopped carp interface: carp0
=== VARIANT B: full path incl. HMAC verify + writes in freed chunk ===
joined 224.0.0.18 on 10.0.0.1
carp0
carp0: state set to 2
carpstats before B:
carp:|	1 packet received (IPv4)|	0 packets received (IPv6)|		0 packets discarded for wrong TTL|		0 packets shorter than header|		0 discarded for bad checksums|		0 discarded packets with a bad version|		0 discarded because packet too short|		0 discarded for bad authentication|		0 discarded for bad vhid|		0 discarded because of a bad address list|	5 packets sent (IPv4)|	0 packets sent (IPv6)|		0 send failed due to mbuf memory error|
M_CARP in-use before destroy: 4 1.83K
/dev/tap0: wrote 74 bytes (variant B1)
>>> destroying carp0 NOW
M_CARP in-use after destroy: 0 0
/dev/tap0: wrote 42 bytes (variant B2)
carpstats after B (post-destroy frag2):
carp:|	2 packets received (IPv4)|	0 packets received (IPv6)|		0 packets discarded for wrong TTL|		0 packets shorter than header|		0 discarded for bad checksums|		0 discarded packets with a bad version|		0 discarded because packet too short|		0 discarded for bad authentication|		0 discarded for bad vhid|		0 discarded because of a bad address list|	5 packets sent (IPv4)|	0 packets sent (IPv6)|		0 send failed due to mbuf memory error|
--- dmesg tail (carp) ---
carp0: MAC address: 00:00:5e:00:01:00
carp_proto_input: packet received on stopped carp interface: carp0
carp0: MAC address: 00:00:5e:00:01:00
carp_proto_input: packet received on stopped carp interface: carp0
=== DONE ===