DF-0785 panic signature (from dfbsd-qemu/boot.log)
====================================================

Trigger: crafted NTFS image (root $INDEX_ROOT ir_size=256, va_datalen=896 =>
640-byte heap overflow) mounted read-only, then ~150 unprivileged name lookups
(`stat /mnt/r<N>`) as uid 1001.  Each lookup runs ntfs_ntlookupfile which does:

    rdbuf = kmalloc(blsize=256, M_TEMP, M_WAITOK);          // ntfs_subr.c:888
    ntfs_readattr(... rdsize=896 ... rdbuf);                 // ntfs_subr.c:890-891

writing 896 attacker-controlled bytes (0x41434244 pattern) into the 256-byte
object => 640-byte heap overflow corrupting neighbour slab chunks, including
free-list c_Next pointers.

The periodic slab cleanup timer later walks the corrupted free list and trips
the INVARIANTS zone-alignment assertion:

panic: assertion "(((intptr_t)chunk ^ (intptr_t)z) & ZoneMask) == 0" failed in chunk_mark_free at /usr/src/sys/kern/kern_slaballoc.c:1675
cpuid = 4
Trace beginning at frame 0xfffff8008975f950
chunk_mark_free() at chunk_mark_free+0x99 0xffffffff80655da9
chunk_mark_free() at chunk_mark_free+0x99 0xffffffff80655da9
slab_cleanup() at slab_cleanup+0xbb 0xffffffff8065662b
slotimer_callback() at slotimer_callback+0x11 0xffffffff80687d81
softclock_handler() at softclock_handler+0x1b8 0xffffffff80688438
Debugger("panic")

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

Attribution
-----------
The only heap-corruption source active on the guest at the time was the DF-0785
ntfs_ntlookupfile overflow (ntfs.ko loaded, crafted image mounted, lookups in
flight).  The corrupted c_Next free-list pointer carried the 0x41434244 pattern
written by the overflow.  The KKASSERT at kern_slaballoc.c:1675 fires because a
chunk pointer whose zone-alignment bits are wrong (corrupted) is passed to
chunk_mark_free during slab_cleanup.