=== DF-0624 fix validation: BEFORE / AFTER (same PoC, CLAIM_PCOUNT=65535 BODY=200) ===

TEST KERNEL: DragonFly 6.5-DEVELOPMENT #0 (Thu Jul 2 06:02:54 UTC 2026)
FIX LOCATION: smb_t2_placedata() is in smbfs.ko (the netsmb/CIFS client code is
              bundled into the smbfs module).  Validated by swapping ONLY the
              rebuilt smbfs.ko (smb_rq.c fix); the base kernel was unchanged.

--- BEFORE (unpatched /boot/kernel/smbfs.ko) ---
Guest client: kldload smb; mount_smbfs -N -I 10.0.2.2 //guest@10.0.2.2/share; ls
Result: kernel PANIC, guest DOWN.  dfbsd-qemu/boot.log:
    netsmb_dev: loaded
    bug: ecnt = 16705, but data is NULL (please report)     # 16705 == 0x4141 (attacker fill)
    md_get_mem(474): incomplete copy                         # OOB read of inflated mbuf
    ... (repeated) ...
    panic: overflowed mbuf 0xfffff801175c3c00
    Trace: m_free -> m_free -> m_freem -> md_done -> smb_t2_done -> smbfs_findclose
    Debugger("panic") -> db>   [GUEST DOWN]
(see panic.txt)

--- AFTER (fixed /boot/kernel/smbfs.ko: if(count>len){m_freem(m0);return EBADRPC;}) ---
Same client + same malicious server (CLAIM_PCOUNT=65535).
server.log: NEGOTIATE -> SESSION_SETUP -> TREE_CONNECT ->
            TRANS2(mid=3, LIE) -> CLOSE -> TRANS2(mid=5, LIE) -> CLOSE -> TREE_DISCONNECT -> clean close.
Result: mount/ls returns, LS_RC=0, GUEST UP.  dmesg after run:
    netsmb_dev: loaded
    (NO ecnt, NO incomplete copy, NO panic)
=> The lying TRANS2 response is now rejected with EBADRPC inside smb_t2_placedata
   BEFORE m_len is mutated; smb_t2_reply breaks out of the receive loop; the file
   op fails benignly.  FIX CONFIRMED.