/* DF-3427 — netmap generic TX destructor interception is ABI-incompatible
 *          with DragonFly mbufs: ext_free is invoked with the CLUSTER, not
 *          the mbuf (type confusion -> OOB read -> wild pointer deref,
 *          plus permanent cluster leak).
 *
 * Source chain (verified path:line):
 *
 *  sys/net/netmap/netmap_generic.c:101-104
 *      #define SET_MBUF_DESTRUCTOR(m, fn) do {              \
 *              (m)->m_ext.ext_free = (void *)fn;            \
 *          } while (0)
 *  sys/net/netmap/netmap_generic.c:439   (from generic_set_tx_event,
 *                                        called at :538/:573)
 *      SET_MBUF_DESTRUCTOR(m, generic_mbuf_destructor);
 *  sys/net/netmap/netmap_generic.c:322-338
 *      static void generic_mbuf_destructor(struct mbuf *m) {
 *          netmap_generic_irq(MBUF_IFP(m), MBUF_TXQ(m), NULL);
 *          ...
 *          m->m_ext.ext_free = NULL;
 *      }
 *
 *  But DragonFly calls  m->m_ext.ext_free(m->m_ext.ext_arg)
 *  (sys/kern/uipc_mbuf.c:1412 and :1433), and for an m_getcl() pool mbuf
 *  ext_arg is the 16-byte `struct mbcluster *` (uipc_mbuf.c:652,
 *  linkjcluster).  So `m` above is actually a struct mbcluster:
 *
 *      MBUF_IFP(m) == ((struct mbuf *)cl)->m_pkthdr.rcvif
 *                   == *(void **)((char *)cl + 40)      <-- 24 bytes past
 *                                                          the 16-byte object
 *
 *  (struct m_hdr is 40 bytes on x86_64; struct pkthdr's first member is
 *  rcvif; struct mbcluster is { int32_t mcl_refs; void *mcl_data; } = 16B.)
 *  The value read is adjacent objcache memory (typically another
 *  mbcluster's mcl_data kernel pointer) -> netmap_generic_irq(garbage_ifp)
 *  derefs ifp->if_capenable (netmap_generic.c:171) and, if the bit happens
 *  to match IFCAP_NETMAP, netmap_common_irq() derefs NA(ifp)=ifp->if_softc
 *  and calls na->nm_notify on the garbage pointer.
 *
 *  Additional deterministic damage: the destructor replaces m_mclfree, so
 *  the cluster's mcl_refs is never decremented -> every event mbuf leaks
 *  its 2KB cluster permanently; mclmeta_dtor() later KKASSERTs mcl_refs==0
 *  on objcache reclaim (uipc_mbuf.c:632-635) -> INVARIANTS panic under
 *  memory pressure.  And `m->m_ext.ext_free = NULL` at :331 is a write
 *  through the type-confused (already-freed) mbuf pointer.
 *
 *  Trigger: TX ring full or dispatch failure on a generic netmap adapter
 *  -> generic_set_tx_event() installs the destructor and m_freem()s the
 *  pool mbuf (also DF-3426) -> free path invokes the destructor with the
 *  cluster pointer.
 *
 *  Platform fact: the netmap KLD does not build on this tree
 *  (netmap_build.log) — analysis only.
 */
int main(void) { return 1; }