DF-0771 harness: sizeof(struct hammer_inode_data) = 128
CRC test for INODE leaf with data_len=1, data_crc=0:
   vol_version=6 -> PASS (1=CRC PASSES = inode loaded)
   vol_version=7 -> PASS (1=CRC PASSES = inode loaded)
BUG PART 1 CONFIRMED: CRC gate bypassed -- wrong-sized INODE record
   is accepted because hammer_crc_get_leaf() returns 0 for INODE with
   data_len!=sizeof(inode_data), and on-disk data_crc=0 matches 0==0.

TEST 2: xoff=16280, struct copy reads 128 bytes at [16280..16408)
   HAMMER buffer occupies [0..16384). OOB region = [16384..16408) = 24 bytes past buffer end.
   inode_data bytes copied from PAST the 16 KiB buffer (leaked 0x77 marker): 24
   inode_data.atime (last 8 bytes, all in OOB region) hex: 77 77 77 77 77 77 77 77
BUG PART 2 CONFIRMED: struct copy at hammer_inode.c:525 read 24 bytes
   past the 16 KiB HAMMER data buffer end into adjacent kernel heap.
   Those leaked bytes populate inode_data fields (mode/uid/gid/size/
   ext.symlink[24]/mtime/atime) returned to userspace via stat()/readlink().

==== DF-0771 REPRODUCED (info-leak / heap OOB read) ====
Threat model: crafted HAMMER filesystem image mounted by root/operator/
  removable media. Realistic impact ceiling: kernel heap info leak
  (KASLR-defeat class); NOT a write primitive -> no privilege-escalation
  chain derivable (read-only primitive = valid Phase-6 stop).