at the user level, it is easy to send packets using functions such as socket sendto.
in the kernel layer, if you use skb to send packets, it always feels like writing from the underlying wheel.

within the BSD kernel, you should be able to send simple echo packets using socket.

Creating and Destroying Sockets

A new socket may be created using socreate().  As with socket(2),
arguments specify the requested domain, type, and protocol via dom, type,
and proto.  The socket is returned via aso on success.  In addition, the
credential used to authorize operations associated with the socket will
be passed via cred (and will be cached for the lifetime of the socket),
and the thread performing the operation via td.  Warning: authorization
of the socket creation operation will be performed using the thread
credential for some protocols (such as raw sockets).

Sockets may be closed and freed using soclose(), which has similar
semantics to close(2).

In certain circumstances, it is appropriate to destroy a socket without
waiting for it to disconnect, for which soabort() is used.  This is only
appropriate for incoming connections which are in a partially connected
state.  It must be called on an unreferenced socket, by the thread which
removed the socket from its listen queue, to prevent races.  It will call
into protocol code, so no socket locks may be held over the call.  The
caller of soabort() is responsible for setting the VNET context.  The
normal path to freeing a socket is sofree(), which handles reference
counting on the socket.  It should be called whenever a reference is
released, and also whenever reference flags are cleared in socket or
protocol code.  Calls to sofree() should not be made from outside the
socket layer; outside callers should use soclose() instead>.

results from man

but there will be problems when these functions are called, for example, when socreate, is used in this way, it will kernel panic directly.

error = socreate(AF_INET, &so, SOCK_DGRAM, 0, td->td_ucred, td);

so I tried to use sys_sendto to send packets again.

    error = sys_sendto(td, &sendto);
    

14 is always returned here, so I think this call may have an action of copyinstr.

how to send UDP echo packets out of the FreeBSD kernel.