DF-0766 reachability analysis
MCLBYTES=2048  reply header H=124 (mod4=0)  sizeof(flrep)=132 (mod4=0)

Alignment invariant: for entry i,
  name_end_i = H + sum(prior entry totals) + 16 + nlen_i
every term is a multiple of 4 except nlen_i, so name_end_i mod 4 == nlen_i mod 4.
bp==be at the pad loop requires name_end_i == 0 (mod 2048) == 0 (mod 4),
which requires nlen_i == 0 (mod 4), i.e. rem_i == 0 -> pad loop writes nothing.

=== NFSv3 READDIR ===
trace: 256 entries all nlen=7 (rem=1):
  -> OOB-state entries in this trace: 0

exhaustive+random brute force over directory layouts: max OOB-state entries found = 0
CONCLUSION: the claimed OOB state (bp==be at pad loop with rem>0) is UNREACHABLE.

=== NFSv3 READDIRPLUS ===
trace: 256 entries all nlen=7 (rem=1):
  -> OOB-state entries in this trace: 0

exhaustive+random brute force over directory layouts: max OOB-state entries found = 0
CONCLUSION: the claimed OOB state (bp==be at pad loop with rem>0) is UNREACHABLE.

FINAL VERDICT: the missing nfsm_clget before the pad bytes is a real
code-quality gap, but the claimed heap OOB write is UNREACHABLE because the
XDR 4-byte alignment invariant guarantees the name never ends exactly on a
cluster boundary when padding is needed.  Impact: none (latent hardening gap).