DF-0775 fix validation — patched #1 kernel
==========================================
Kernel: DragonFly 6.5-DEVELOPMENT #1 (Wed Jul  8 09:23:00 UTC 2026)
        sha256(kernel) = 59a826e35b5d861607af9bfdbdbaaddf78bbe968a24574765504e296832572f6
Fix: bounds check added at nfs_socket.c:1500:
     if (i < 0 || i > RPCAUTH_MAXSIZ) { error = EBADRPC; goto nfsmout; }

The same malicious server + mount_nfs test was re-run on the patched kernel.

Result: IDENTICAL to baseline — NFS ops return EBADRPC, guest stays up.

  mount: 127.0.0.1:/x on /mnt_df0775 (nfs)
  $ ls /mnt_df0775
  ls: /mnt_df0775: RPC struct is bad

Server log confirms the malicious verifier was still delivered:
  [EVIL] prog=100003 vers=2 proc=1 xid=0x275A34D4 -> verifier_len=0x7FFFFFFD
  [EVIL] prog=100003 vers=2 proc=1 xid=0x275A34D5 -> verifier_len=0x7FFFFFFD
  [EVIL] prog=100003 vers=2 proc=1 xid=0x275A34D6 -> verifier_len=0x7FFFFFFD

BEFORE/AFTER comparison:
  Baseline (#0, unpatched): EBADRPC — no panic, no OOB read
  Patched  (#1, with fix):  EBADRPC — no panic, no OOB read

The fix closes the defense-in-depth gap (verifier length now bounded at
400 bytes, signed overflow eliminated), but since the claimed impact
(panic/OOB) never manifested on either kernel due to the int-truncation
defense in nfsm_dissect(), the observable behavior is identical.