DF-0779 PANIC SIGNATURE (unpatched 6.5-DEVELOPMENT #0 kernel)
Captured from dfbsd-qemu/boot.log after `./df0779_trigger /tmp/df0779_export 0xDEAD`
(NFSv3 READDIR with bogus cookie 0xDEAD against an NFS-exported tmpfs dir).

panic: assertion "uio->uio_offset == off" failed in tmpfs_readdir at /usr/src/sys/vfs/tmpfs/tmpfs_vnops.c:1730
cpuid = 5
Trace beginning at frame 0xfffff80117cbf260
tmpfs_readdir() at tmpfs_readdir+0x537 0xffffffff809965c7 
tmpfs_readdir() at tmpfs_readdir+0x537 0xffffffff809965c7 
vop_readdir() at vop_readdir+0x6b 0xffffffff8070b17b 
nfsrv_readdir() at nfsrv_readdir+0x378 0xffffffff807fdba8 
sys_nfssvc() at sys_nfssvc+0x40f 0xffffffff80807cff 
syscall2() at syscall2+0x11e 0xffffffff80bd6a0e 
Debugger("panic")

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Call chain confirms the NFS-server READDIR path (nfsrv_readdir -> vop_readdir
-> tmpfs_readdir). The bogus client cookie desyncs tmpfs_readdir's NFS
cookie-generation block (tmpfs_vnops.c:1697-1731) from tmpfs_dir_getdents(),
violating the KKASSERT(uio->uio_offset == off) invariant at line 1730.

NOTE: local getdents does NOT reach this block (it passes cookies=NULL,
vfs_syscalls.c:4645) -- empirically confirmed: ./df0779_local on /tmp (tmpfs)
with bogus cookies 0xDEAD / 0x7FFF...FF / 0x4141...41 / 0x0BADF00D all returned
gracefully (no panic, guest stayed up).