=== DF-0784 harness: ext2_readlink arithmetic transcription ===
ip->i_size (uint64)   = 0x0000000080000000
isize (int, truncated)= -2147483648  (0x80000000)
isize (int -> size_t) = 0xffffffff80000000  (sign-extended)
EXT2_MAXSYMLINKLEN    = 60
isize < MAXSYMLINKLEN ? YES  (TRUE => fast path TAKEN)
user buffer size      = 4096 bytes
readlink returned     = 4096 bytes  (rc=0)
legit target length   = 18 bytes
[!!] LEAKED 4078 bytes of fake-kernel-heap past the legit target

first 64 bytes of user buffer (target string then poison):
74 61 72 67 65 74 5f 66 6f 6f 62 61 72 5f 6c 69 
6e 6b b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf 
c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf 
d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df 

bytes 32-64 from offset 2000 (deep into the over-read region):
b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf 
c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf 

last 32 bytes of user buffer:
61 6e 73 63 72 69 70 74 69 6f 6e 20 3d 3d 3d 0a 
69 70 2d 3e 69 5f 73 69 7a 65 20 28 75 69 6e 74 


Conclusion: a -2147483648-byte int truncation of a uint64 i_size yields a
size_t count of 0xffffffff80000000; uiomove copies that many bytes from
i_shortlink into user RAM, bounded only by the user buffer / the
first unmapped kernel page.  In the live kernel (see panic.txt) the
latter ends in a vm_fault panic from ext2_readlink+0x48.