### uname
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
### tunsifmode
flags at open:                   0x8010  [PTP MCAST ]
after TUNSIFMODE(BCAST):         0x8002  [BCAST MCAST ]
after TUNSIFMODE(BCAST|MCAST):   0x8002  [BCAST MCAST ]

raw word with extraneous bit ACCEPTED (a masked-value inject would be indistinguishable here;
the raw OR is at if_tun.c:737 ifp->if_flags |= *(int *)data)
VERDICT: REPRODUCED (mechanism; injectable delta is limited to the IFF_MULTICAST bit, which tun(4) always has set -- no stock config delta)
TUNSIFMODE(BCAST|0x100) -> Invalid argument (switch equality holds)
### bpffailopen
filters loaded on vtnet0 (bpf_mtap mbuf path): H(k=1000 out-of-range halfword) and W(k=1000 word)
generating 5 small vtnet0 packets (ping 10.0.2.2)...
packet 1: captured-by-H=1 captured-by-W=0
packet 2: captured-by-H=1 captured-by-W=0
packet 3: captured-by-H=1 captured-by-W=0
packet 4: captured-by-H=1 captured-by-W=0
packet 5: captured-by-H=1 captured-by-W=0

VERDICT: REPRODUCED -- out-of-range BPF_H load kept the filter running (fail-open, packets accepted) while the identical BPF_W filter correctly rejected them
### chack 300
established 127.0.0.1:4722 <-> 127.0.0.1:44442 (client port picked: 4722)
sent 300 spoofed out-of-window segments in 0.010 s (29172 pkt/s)
VERDICT: see ack-only counter delta (driver script measures it)
ack-only packets: before=337 after=640 delta=303 (sent 300 OOW segments)
tcpdump saw: 303 pkts from server
17:33:49.639236 IP 127.0.0.1.44442 > 127.0.0.1.4722: Flags [.], ack 1, win 1792, options [nop,nop,TS val 12199 ecr 12198,nop,nop,sack 1 {2463124771:2463124775}], length 0
17:33:49.639391 IP 127.0.0.1.44442 > 127.0.0.1.4722: Flags [.], ack 2, win 1792, options [nop,nop,TS val 12199 ecr 12199], length 0
17:33:49.641884 IP 127.0.0.1.44442 > 127.0.0.1.4722: Flags [R.], seq 1, ack 2, win 1792, length 0
### rtleak (setup + unpriv listener)
poisoned alias added: lo0 127.200.0.200 sin_len=200
filler aliases added: 127.200.0.201..205 sin_len=16
SETUP-OK
poisoned alias added: lo0 127.200.0.200 sin_len=200
filler aliases added: 127.200.0.201..205 sin_len=16
SETUP-OK
[IFLIST] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       (none in this copy)
[IFLIST] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       (none in this copy)
NET_RT_IFLIST: 11 poisoned (sa_len>16) sockaddr(s) found

listening on PF_ROUTE for 12s (driver will poke lo0 alias)...
[DELADDR] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       (none in this copy)
[DELADDR] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       (none in this copy)
[NEWADDR] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       off  72: 0xfffff8004f2e79d8
       off  80: 0xfffff8004f2e79e8
       off  88: 0xfffff8004f2e79f8
[NEWADDR] sa_len=200 family=2 addr=127.200.0.200
     candidate kernel pointers past offset 48 (object end):
       off  56: 0xfffff8004f2e79d8
       off  64: 0xfffff8004f2e79e8
       off  72: 0xfffff8004f2e79f8
PF_ROUTE events with poisoned sockaddr: 12
VERDICT: REPRODUCED -- rtsock builders copied sa_len bytes from an allocation smaller than sa_len and delivered them to an unprivileged listener