=== DF-0786: Off-by-one harness (guard-page proof) ===
Bug: ntfs_ntlookupattr (ntfs_subr.c:826-828)
  kmalloc(namelen) then buf[namelen]='\0' → 1 byte past allocation

Testing buf placed at page boundary (buf[namelen] hits guard page):
  namelen=  1: buf[1] = SIGSEGV (OOB WRITE CONFIRMED)
  namelen=  2: buf[2] = SIGSEGV (OOB WRITE CONFIRMED)
  namelen=  4: buf[4] = SIGSEGV (OOB WRITE CONFIRMED)
  namelen=  8: buf[8] = SIGSEGV (OOB WRITE CONFIRMED)
  namelen= 16: buf[16] = SIGSEGV (OOB WRITE CONFIRMED)
  namelen= 32: buf[32] = SIGSEGV (OOB WRITE CONFIRMED)

Conclusion: buf[namelen] is ALWAYS 1 byte past the kmalloc(namelen)
allocation. In the kernel slab allocator, when namelen equals a bucket
boundary (8, 16, 32, 64, ...), the NUL byte overwrites the first byte
of the adjacent slab chunk — a heap OOB write (CWE-787).