DF-0780 — fix-validation: PATCHED kernel #1 + patched fuse.ko (run.log)
======================================================================
Kernel: DragonFly 6.5-DEVELOPMENT #1: Wed Jul  8 10:07:29 UTC 2026
        (built with `make -j6 nativekernel KERNCONF=X86_64_GENERIC` from
         /usr/src after applying findings/poc/DF-0780/fix.diff; FUSE is
         module-only so the fix is exercised via the rebuilt fuse.ko)
fuse.ko: rebuilt from patched /usr/src/sys/vfs/fuse (contains the DF-0780
         bound check in fuse_io_execute).

Run #1 (decisive):
  ./dfbsd-qemu/vm.sh run_root 'cd /home/maxx/poc/DF-0780 && sh run.sh'
  daemon pid=869
  /dev/fuse on /mnt/fuse (fuse, local)
  === triggering read as maxx ===
  cat: /mnt/fuse/target: Invalid argument
  cat rc=1
  === guest survived; daemon log: ===
  [daemon] READ node=2 off=0 reqsize=8192  REPLYING 131072 bytes (OVERFLOW 122880 past reqsize buf)
  evil_daemon: daemon writev failed: Protocol error

  Guest status: UP   (no panic; nothing in boot.log)

Run #2:
  cat: /mnt/fuse/target: Invalid argument ; cat rc=1 ; status=up ; panic=
Run #3:
  cat: /mnt/fuse/target: Invalid argument ; cat rc=1 ; status=up ; panic=

Conclusion (fix VALIDATED):
  BEFORE (unpatched #0 + stock fuse.ko): oversized READ reply -> memcpy OOB
       write -> panic (trap 12 page fault in memcpy), 3/3 runs.
  AFTER  (#1 + patched fuse.ko):         oversized READ reply -> bound check
       (olen > bp->b_bcount) refuses the memcpy -> bp->b_error=EINVAL ->
       cat prints "Invalid argument", NO panic, guest stays up, 3/3 runs.

The daemon's writev still gets EPROTO (the pre-existing fuse_audit_length
advisory), and now the consumer (fuse_io_execute) also refuses the oversized
copy, so the OOB memcpy can no longer occur.