# DF-3384 — BIOCFLUSH concurrent with in-flight bpfread() loses the buffer-slot invariants

bpfread() (sys/net/bpf.c:541-545) clobbers bd_fbuf with bd_hbuf after
uiomove(); if the reader blocked in uiomove (page fault -> bpf_token
released) and a BIOCFLUSH on a dup'd fd ran bpf_resetd() meanwhile
(bpf.c:674-686), the buffer pointer parked in bd_fbuf is lost: permanent
kmalloc leak, and after the next immediate-mode read bd_sbuf becomes NULL,
so the next tapped packet makes catchpacket() write the bpf header through
a NULL store buffer (bpf.c:1455-1458) - kernel write to address 0.

## Reproduce attempt
cc -O -o trigger trigger.c -pthread ; ./trigger
Three variants tried (timing-scan over anon faults; BIOCFLUSH spam with
anon faults; BIOCFLUSH spam with cold file-backed faults).  None landed on
this virtualized guest - see VERDICT.md for why (faults never yield the
token long enough).  not_reproduced, defect likely from code arithmetic.