ICMP PULLUP_TO(hlen+4) reads icmp_id at hlen+4..hlen+5: 2-byte mbuf backing-store over-read on crafted short ICMP packets

Summary

ip_fw3_chk pulls up only 4 bytes of ICMP header PULLUP_TO(hlen+4) at :400 but reads icmp->icmp_id at :403 uint16_t spanning offsets hlen+4..hlen+5. For ICMP packet with 4-byte ICMP body (ip_len=hlen+4=24 for 20-byte IP header) reads 2 bytes past guaranteed m_len sourcing stale mbuf backing-store data into dst_port/src_port used for firewall matching. PULLUP_TO only guarantees m->m_len>=hlen+4. struct icmp has icmp_hun(icd_id) at offset 4..7. Remote-triggerable firewall misclassification primitive driven by kernel heap contents. pfil hook runs before ip_input validates ICMP length.