AF_INET6=28 SOCK_DGRAM=2 RUNS=20
bytes 17..19 of sin6_addr are past the 17-byte sockaddr that
connect(2) copied in; they come from a freed 24-byte M_SONAME
chunk groomed by the preceding bind(2).

A(groom 00 ff ff) first errno=49 (Can't assign requested address)
B(groom 00 00 00) first errno=22 (Invalid argument)
C(no groom)      first errno=22 (Invalid argument)

summary over 20 rounds per variant:
  A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
  B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
  C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0

RESULT: VULNERABLE -- connect(2) error code is chosen by heap bytes OUTSIDE the supplied sockaddr length (read before sa_len validation).
EXIT=0