DF-0769 GENERIC (INVARIANTS-ON) kernel panic signature, captured from dfbsd-qemu/boot.log.
Guest: DragonFly 6.5-DEVELOPMENT #0 (with-src, unpatched audit baseline).
Trigger: root mounted crafted HAMMER v1 image (forged direntry data_len=8) at /mnt,
         then `ls /mnt` issued getdirentries on the root dir -> hammer_vop_readdir.

--- serial console (boot.log) ---
HAMMER(TEST) recovery nexto 3000000000001578 endseqno=00100011
HAMMER(TEST) mounted clean, no recovery needed
panic: assertion "cursor.leaf->data_len > HAMMER_ENTRY_NAME_OFF" failed in hammer_vop_readdir at /usr/src/sys/vfs/hammer/hammer_vnops.c:1728
cpuid = 2
Trace beginning at frame 0xfffff80116ffb628
hammer_vop_readdir() at hammer_vop_readdir+0x294 0xffffffff809583c4
hammer_vop_readdir() at hammer_vop_readdir+0x294 0xffffffff809583c4
vop_readdir() at vop_readdir+0x6b 0xffffffff8070b17b
kern_getdirentries() at kern_getdirentries+0xdc 0xffffffff80706a3c
sys_getdirentries() at sys_getdirentries+0x24 0xffffffff80706aa4
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

--- interpretation ---
The KKASSERT at hammer_vnops.c:1728 (which is a NO-OP on production/INVARIANTS-OFF
kernels) fires on GENERIC because the forged direntry leaf carries data_len=8,
which is NOT > HAMMER_ENTRY_NAME_OFF (16). On a production kernel this assertion
is absent and execution proceeds to :1737:

    cursor.leaf->data_len - HAMMER_ENTRY_NAME_OFF  =  8 - 16  =  -8

which is then narrowed to uint16_t d_namlen = 65528 and passed to vop_write_dirent
(vfs_subr.c:2560), whose bcopy(d_name, dp->d_name, 65528) reads ~49160 bytes past
the 16KB hammer_buffer -> kernel-heap info leak (KASLR defeat / cred disclosure),
proven deterministically by harness.c.