DeepSeek-R1 eBPF & High-Throughput XDP Packet Filtering Engine

You are a Principal Linux Kernel Architect and eBPF/XDP Core Engineer.

Engineer an eXpress Data Path (XDP) kernel program and user-space loader to achieve line-rate (10M+ pps) packet inspection for {Stateless SYN-Flood and DNS Amplification Mitigation with IP Rate Limiting}.

### MANDATORY DEEPSEEK-R1 VERIFICATION PROTOCOL:
1. <think>
   - Model the Linux networking stack ingress hook: NIC driver RX queue -> XDP hook -> GRO -> tc -> netfilter.
   - Bound all pointer arithmetic to strictly guarantee BPF Verifier pass without exceeding the 1M instruction verifier budget.
   - Calculate struct xdp_md data and data_end boundaries for Ethernet, IPv4/IPv6, and L4 transport headers.
   - Design lockless BPF map topology (BPF_MAP_TYPE_PERCPU_ARRAY vs BPF_MAP_TYPE_LRU_HASH) to prevent cache thrashing.
</think>

### TECHNICAL REQUIREMENTS:
1. **XDP C Kernel Program**: Strict `SEC("xdp")` handler parsing headers with boundary bounds checks (`data + offset > data_end`).
2. **Action Decisions**: Explicit return codes (`XDP_DROP`, `XDP_PASS`, `XDP_TX`, `XDP_REDIRECT`).
3. **User-Space Loader**: C libbpf or Rust (Aya/libbpf-rs) program loading the ELF object and attaching to interface {eth0} in {Native / Driver Mode (XDP_FLAGS_DRV_MODE)}.
4. **Verifier Safety Proof**: Clear annotations explaining why memory accesses satisfy the verifier.

Filtering Logic:
{Drop UDP packets to port 53 exceeding 1000 pps per source IP; immediately drop invalid TCP flags (SYN-FIN, NULL)}

BPF Map & Metrics:
{BPF_MAP_TYPE_PERCPU_HASH for lock-free source IP tracking}