DF-3337 sequential control — W=1 N=16 R=1, NCONN=10, STOCK pf.ko
(captured live 2026-09-11; run right before the concurrent arms)
  flooding: 1 workers x 16 sources x 2 conns x 1 rounds ...
  round 0: WALK=   65552 expected=65552 MISSING=0
  TOTAL MISSING ENTRIES OVER 1 ROUNDS: 0
  blocking: 47   (dmesg "pf_src_connlimit: blocking address" prints --
                  every source's overload fired; 47 > 16 due to multiple
                  firings per source across CPUs)
NOTE: an earlier control with NCONN=2 (archived below) lost 217/256
because with only 2 connections per source the per-CPU source-tracking
threshold usually never accumulates (pf.c tree_src_tracking[cpu]);
NCONN=10 guarantees >=2 land on one CPU (pigeonhole over 6 netisr CPUs)
and is used for BOTH arms of the comparison.
  [archived NCONN=2 control, informational:]
  flooding: 1 workers x 256 sources x 2 conns x 1 rounds ...
  round 0: WALK=   65575 expected=65792 MISSING=217