=== BASELINE (unpatched ntfs.ko, kernel #0): stat /mnt/ntfs/a on ntfs_0791.img ===
vnconfig -c vn0 /root/ntfs_0791.img
mount_ntfs -o ro /dev/vn0 /mnt/ntfs        -> MOUNT_RC=0
stat /mnt/ntfs/a                            -> HANG (120s timeout), guest DOWN

Result: panic: lockmgr: locking against itself at ntfs_ntlookupfile+0x57
(sibling NTFS directory-lookup defect fires before the subnode dive; see panic.txt).
The DF-0791 dive OOB read is therefore sibling-blocked on the live kernel and is
proven deterministically by the guard-page harness (run.log).