# DF-3441 — div_bind() writes into the user bind sockaddr before validation

`div_bind()` (sys/netinet/ip_divert.c:456-479) executes
`((struct sockaddr_in *)nam)->sin_addr.s_addr = INADDR_ANY;` at offset 4..8
of the caller-supplied sockaddr BEFORE any sa_len validation (in_pcbbind
checks `sa_len != sizeof *sin` only afterwards). With a 4-byte bind sockaddr
(getsockaddr minimum) the 4-byte zero write lands past the requested size —
inside the 8-byte slab chunk's slack (zoneindex: sub-128B allocations round
to 8-byte multiples, kern_slaballoc.c:638-645), so no adjacent-object
corruption occurs on this allocator. Correctness/UB bug, no demonstrated
security impact.

## Build / run (root: divert socket)
    cc -O -o div3441 div3441.c && ./div3441

## Observed
    bind(4B AF_INET sockaddr) = -1 errno=22 (Invalid argument)
EINVAL (not EAFNOSUPPORT) proves div_bind's else-branch — the write line —
executed, with in_pcbbind rejecting the length afterwards. Note a fixed
div_bind (early sa_len check) returns the same EINVAL, so this marker proves
path execution on the current kernel, not a behavioral difference.