=== run 1 ===
AF_INET6=28 SOCK_DGRAM=2 RUNS=20
target: udp6_usrreq.c:596-600 reads sin6_addr (offsets 8..19)
before ANY sa_len check; bytes 17..19 come from the groomed
free chunk, outside the 17-byte connect(2) sockaddr.

A(groom 00 ff ff) first errno=49 (Can't assign requested address)
B(groom 00 00 00) first errno=22 (Invalid argument)
C(no groom)      first errno=22 (Invalid argument)

summary over 20 rounds per variant:
  A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
  B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
  C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0

RESULT: VULNERABLE -- udp6_connect()'s errno is chosen by heap bytes OUTSIDE the supplied sockaddr length (read at udp6_usrreq.c:597 before any validation).
=== run 2 ===
AF_INET6=28 SOCK_DGRAM=2 RUNS=20
target: udp6_usrreq.c:596-600 reads sin6_addr (offsets 8..19)
before ANY sa_len check; bytes 17..19 come from the groomed
free chunk, outside the 17-byte connect(2) sockaddr.

A(groom 00 ff ff) first errno=49 (Can't assign requested address)
B(groom 00 00 00) first errno=22 (Invalid argument)
C(no groom)      first errno=22 (Invalid argument)

summary over 20 rounds per variant:
  A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
  B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
  C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0

RESULT: VULNERABLE -- udp6_connect()'s errno is chosen by heap bytes OUTSIDE the supplied sockaddr length (read at udp6_usrreq.c:597 before any validation).
=== run 3 ===
AF_INET6=28 SOCK_DGRAM=2 RUNS=20
target: udp6_usrreq.c:596-600 reads sin6_addr (offsets 8..19)
before ANY sa_len check; bytes 17..19 come from the groomed
free chunk, outside the 17-byte connect(2) sockaddr.

A(groom 00 ff ff) first errno=49 (Can't assign requested address)
B(groom 00 00 00) first errno=22 (Invalid argument)
C(no groom)      first errno=22 (Invalid argument)

summary over 20 rounds per variant:
  A groom 00 ff ff : EADDRNOTAVAIL=20 EINVAL=0 other=0
  B groom 00 00 00 : EADDRNOTAVAIL=0 EINVAL=20 other=0
  C no groom       : EADDRNOTAVAIL=0 EINVAL=20 other=0

RESULT: VULNERABLE -- udp6_connect()'s errno is chosen by heap bytes OUTSIDE the supplied sockaddr length (read at udp6_usrreq.c:597 before any validation).
RUNS-DONE
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64