# DF-3440 — div_output() reads an under-sized destination sockaddr

`div_send()` (sys/netinet/ip_divert.c:494-508) hands the user `sendto()`
destination to `div_output()` (ip_divert.c:317-373) with no length
validation. `getsockaddr()` (kern/uipc_syscalls.c:1513-1532) kmalloc's
exactly `namelen` bytes (min 4). `div_output()` reads:

- `sin->sin_port` at offset 4..8  (OOB for namelen < 8)  -> divinfo->skipto
- `sin->sin_addr` at offset 8..12 (OOB for namelen < 12) -> re-inject
  direction via DIV_IS_OUTPUT(sin) (`== 0` -> ip_output, else -> ip_input)

Both values steer kernel control flow from bytes past the user allocation.

## Build / run (root: divert socket)
    cc -O -o div3440 div3440.c && ./div3440        # counter/oracle variant
    cc -O -o divleak divleak.c && ./divleak        # skipto-canary readback
    cc -O -o divsteer divsteer.c && ./divsteer     # groom steering variant

## Observed
Every `sendto()` with a 4- or 9-byte sockaddr returns success — the kernel
accepted an under-sized destination and executed the OOB reads (reinject
observed in ip counters). Deterministic value steering / readback could not
be produced on this allocator (grooms don't land; same experience as the
verified DF-3357 PoC on this guest). See run.log and VERDICT.md.