# DF-3378 — MRT6_INIT rejects the standard 4-byte KAME API argument on 64-bit (`sizeof(int *)` vs `sizeof(int)`)

## What

`ip6_mrouter_init()` validates the MRT6_INIT option with

```c
if (!m || (m->m_len != sizeof(int *)))   /* sys/netinet6/ip6_mroute.c:426 */
        return ENOPROTOOPT;
```

`m` is built by `soopt_getm()`/`soopt_to_mbuf()` so `m->m_len` equals the
setsockopt value size. Every conforming routing daemon (pim6sd/pim6dd and the
documented KAME API) passes `int v = 1; setsockopt(s, IPPROTO_IPV6, MRT6_INIT,
&v, sizeof(v))` — 4 bytes. On amd64 `sizeof(int *) == 8`, so `4 != 8` →
**ENOPROTOOPT: IPv6 multicast routing cannot be enabled at all** on 64-bit
DragonFly by any stock daemon. The subsystem becomes reachable only for a
caller that happens to pass 8 bytes (first int = 1).

Side effect for triage: this gate also blocked the whole file's attack surface
(DF-0423/0424-style paths) behind an API no stock daemon uses — while custom /
8-byte callers get full access.

## Reproduce (deterministic, root, stock kernel #0)

```
# cc -O -Wall -o /tmp/df3378 /root/poc/trigger_mrt6_init.c && /tmp/df3378
MRT6_INIT(4-byte int arg): rc=-1 errno=42 (Protocol not available)   <- the bug
MRT6_INIT(8-byte arg):     rc=0  errno=0 (Success)
```

Fixed kernel (`m->m_len < sizeof(int)`): first line becomes `rc=0`.

## Files

* `trigger_mrt6_init.c`, `build.sh`, `run.sh`, `run.log`, `fix.diff`
* `VERDICT.md`, `manifest.json`, `verdict.json`