DF-3317 — kernel panic evidence (stock INVARIANTS kernel, DragonFly 6.5-DEVELOPMENT #0)

Reproduced twice (plus two runs where the fault hit the syscall thread's
context and was delivered as SIGSEGV to the PoC process instead):

  login: Sep 10 17:16:16 dfbsd kernel: pid 880 (ptb6), uid 0: exited on signal 11 (core dumped)
  Sep 10 17:17:53 dfbsd kernel: pid 905 (ptb6), uid 0: exited on signal 11 (core dumped)

  (12x, immediately before the trap, first reproduction:)
  tcpcb 0xfffff8008997b9a0: MSS (0) too small to hold options!
  ...

  Fatal trap 18: integer divide fault while in kernel mode
  cpuid = 0; lapic id = 0
  instruction pointer	= 0x8:0xffffffff807c403e
  stack pointer	        = 0x10:0xfffff8008d1f89a0
  frame pointer	        = 0x10:0xfffff8008d1f8a50
  code segment		=  base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
  processor eflags	= interrupt enabled, resume, IOPL = 0
  current process	= Idle            <- netisr0 context (so_pcbdetach netmsg)
  current thread          = pri 12 (CRIT)
  kernel: type 18 trap, code=0

  CPU0 stopping CPUs: 0x0000003e
   stopped
  Stopped at      tcp_close+0x66e:        divq    %r8,%eax

Interpretation:
  * trap 18 = x86 #DE (integer divide error); the faulting instruction is
    the division in tcp_close() at sys/netinet/tcp_subr.c:1013
        i = (i + tp->t_maxseg / 2) / tp->t_maxseg;
    with tp->t_maxseg == 0 (u_int, tcp_var.h:223), set by tcp_mtudisc()
    (tcp_subr.c:1852-1871) from the forged ICMPv6 PTB's mtu=60
    (maxopd = 60 - 40 - 20 = 0).
  * "MSS (0) too small to hold options!" is the kernel's own tcp_output
    diagnostic firing on the corrupted tcpcb between the PTB and the close.
  * current process = Idle => the close ran from netisr0 via the socket
    detach netmsg => whole-system panic (fatal trap), not a per-process
    signal.  In the runs where the divide fault hit while the closing
    process was current, DFly delivered signal 11 to the process instead.