### mif6 (TCP6 dangling im6o)
tap0 index = 3 (exists: 1)
TCP6 socket: IPV6_MULTICAST_IF cached (setsockopt accepted)
before destroy: getsockopt returns index 3
tap0 destroyed; pcb purge list for TCP6 does not exist (in6_ifattach.c:818-819 purges rip+udp only)
after destroy: getsockopt returns index 3 (deref of freed ifnet)
VERDICT: REPRODUCED -- stale im6o_multicast_ifp dereferenced after interface destruction (returned 3, tap0 was 3)
### greuaf (attempt)
timeout: exec(./greuaf): No such file or directory