RESULT oob_matches=256/256 enoent=1 rejected=0 other=0
RESULT OOB-READ PROVEN: stats returned for a request that supplied ZERO hook-name bytes (kernel strcmp completed the name from stale heap past the sent payload)
RESULT sendto(a) errno=48 (Address already in use)
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc 8.3 [DragonFly] Release/2019-02-22
Id Refs Address                Size Name
 1    9 0xffffffff80200000  1ad8538 kernel
 2    1 0xffffffff81cd9000    7c288 ehci.ko
 3    1 0xffffffff81d56000    8c778 xhci.ko
 4    4 0xffffffff82600000     9000 netgraph.ko
 5    1 0xffffffff82609000     2000 
 6    1 0xffffffff8260b000     1000 
 7    1 0xffffffff8260c000     1000 
-- run environment (DF-3558) --
Guest: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
       root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
       (stock INVARIANTS kernel; QEMU/KVM single-tenant, vm.sh)
Modules (built from clean /usr/src, -Werror clean):
  netgraph.ko, ng_socket.ko, ng_hole.ko, ng_echo.ko
Triggers: /root/poc58/{hole_oob,echo_neg} (cc -O2), run as root;
unpriv uid 1001 (maxx): socket() -> EPERM (caps_priv_check, ngc_attach).