DF-3487 leak samples (captured PADO, sysctl -b debug.ppsbx_capture)

=== BOOT A, run 1 (rich heap adjacency: active ssh traffic in nearby mbufs) ===
PADO length 944. Interesting offsets (PADO-relative):

0x0000: 02 00 00 00 00 01 02 00 00 00 00 99 88 63 11 07   eh + PADO code
0x0010: 00 00 03 9c 01 02 00 04 61 63 6d 65               ph.len=924, AC_NAME "acme"
0x0018: 01 01 03 84                                          SRV tag, len=900
0x001c: 53 45 52 56 4e 41 4d 45                              "SERVNAME" (last real byte at mbuf+31)
---- everything below was read OUT OF BOUNDS past the 32-byte mbuf ----
0x0110: 08 29 63 17 01 f8 ff ff   <- kernel heap ptr 0xfffff80117632908 (mbuf m_next/m_data)
0x0110+8: 3a 00 00 00 02 80 00 00   <- mbuf header fields (m_len/m_flags)
0x0210: 0a 00 02 02 52 54 00 12 34 56 08 00 45 00 00 2c   <- leaked frame: 10.0.2.2, eth 52:54:00:12:34:56, IPv4 TCP
0x0220: 00 00 40 00 40 06 22 bc 0a 00 02 0f 0a 00 02 02   <- to 10.0.2.15, proto TCP
0x0230: 00 16 e4 f4 72 bf a5 fc 00 53 fc 02 60 12 e0 00   <- dst port 22 (ssh), seq 0x72bfa5fc
0x0240: a5 e8 00 00 02 04 05 b4                             <- SYN, MSS option
0x0260: ...  2e 76 6e 30 ...                                <- ifnet name ".vn0"
0x0310: 08 2b 63 17 01 f8 ff ff 4b 00 00 00 02 80 00 00   <- kernel heap ptr 0xfffff80117632b08 + mbuf hdr
0x03a0: 01 04 00 08 80 ba 76 89 00 f8 ff ff                <- AC_COOKIE: sess_con* 0xfffff8008976ba80

Runs 2 and 3 on boot A: byte-identical at all offsets above.

=== BOOT B, run 1 (quiet heap: mostly zeros + cross-object names) ===
(same 944-byte PADO; identical across runs 1-3 — see leak1/2/3.txt)
0x0060: ... 2e 76 6e 31 ...          <- ifnet name ".vn1" (cross-object disclosure)
0x03a0: 01 04 00 08 00 bb 76 89 00 f8 ff ff   <- sess_con* 0xfffff8008976bb00