=== PATCHED ntfs.ko module build (sys/vfs/ntfs, KERNCONF=X86_64_GENERIC make) ===
cd /usr/src && patch -p1 --forward < /root/fix.diff
  Hunk #1 succeeded at 1007.
cd /usr/src/sys/vfs/ntfs && KERNCONF=X86_64_GENERIC make
  ... cc -O2 ... -DKLD_MODULE ... -c ntfs_subr.c ...
  cc -Wl,--build-id=sha1 ... -r -o ntfs.ko (ntfs.o + deps)
  ===> ntfs_iconv
  BUILD_RC=0
ls -l ntfs.ko  -> 56720 bytes (43 text symbols, same as stock)
strings ntfs.ko | grep "malformed index"
  -> ntfs_ntlookupfile: malformed index entry (reclen %u, aoff %u, rdsize %u)

Disassembly confirms bounds check before cn read (ntfs_ntlookupfile @ 0x4a60):
  4d20: test $0x1,%al ; je 530a              ; iep->ie_flag & NTFS_IEFLAG_SUBNODE
  4d28: movzwl 0x8(%r13),%eax                ; load iep->reclen
  4d33: cmp %edi,-0x7c(%rbp) ; jb 53df       ; aoff > rdsize  -> EINVAL
  4d3c: cmp $0x7,%ax           ; jbe 53df     ; reclen < 8     -> EINVAL
  4d4c: cmp %edx,%esi          ; ja 53df      ; reclen > rdsize-aoff -> EINVAL
  4d54: ... (cn read folded into ntfs_cntob multiply, past the checks)
  53df: mov $0x16,%r12d  (EINVAL=22) ; callq kprintf("...malformed index entry...")