# DF-3540 runs (stock INVARIANTS kernel #0, ng7 modules built from /usr/src)

## Run 1: stock modules, mode=self (root)
$ kldload /usr/src/sys/netgraph7/netgraph/netgraph.ko
$ kldload /usr/src/sys/netgraph7/socket/ng_socket.ko
$ kldload /usr/src/sys/netgraph7/bpf/ng_bpf.ko
$ /root/poc40/bpf_cycle self
bpf_cycle: uid=0 mode=self
STEP sockets ready
SET_PROGRAM in: thisHook=x2 ifMatch=x1 ok
SET_PROGRAM in: thisHook=x1 ifMatch=x1 ok
SET_PROGRAM in.x1: thisHook=y1 ifMatch=y1 ok
STEP graph built, injecting 1 byte ...
(ssh session never returns -- kernel died)
=> panic, guest down. Serial console (console_full.txt / panic.txt):
   panic: assertion "ref < &td->td_toks_end" failed in lwkt_gettoken_shared
        at /usr/src/sys/kern/lwkt_token.c:732
   lwkt_gettoken_shared() x2
   ng_apply_item() x3+ (recursive; trace truncated)
   Debugger("panic")

## Run 2: stock modules, mode=cross (root) -- cycle WITHOUT any self-reference
$ /root/poc40/bpf_cycle cross
bpf_cycle: uid=0 mode=cross
STEP sockets ready
SET_PROGRAM in: thisHook=e ifMatch=p ok
SET_PROGRAM in: thisHook=r ifMatch=p ok
SET_PROGRAM in.p: thisHook=q ifMatch=s ok
STEP graph built, injecting 1 byte ...
=> same panic (console_cross.txt), guest down.

## Unprivileged check (see unpriv_check.txt)
uid 1001: control socket -> EPERM (ng7 ngc_attach caps_priv_check).
Root-only trigger.

## Fix validation
stage 1 (ng_bpf.c fix only, framework guard disabled):
  fix1_self.log  -- self programs rejected with EINVAL, NO panic, guest up.
  fix1_cross.log -- cross mode STILL panics (framework guard required).
stage 2 (full fix: ng_bpf.c + ng_base.c hop bound):
  fix2_self.log  -- EINVAL rejection, survives 30s+.
  fix2_cross.log -- cycle bounded (ELOOP), survives 30s+, guest up.