=== PATCHED ntfs.ko installed (/boot/kernel/ntfs.ko), kernel #0: stat /mnt/ntfs/a ===
kldstat -v | grep ntfs   -> 4 1 0xffffffff82600000 8000 ntfs.ko (patched, loaded on mount)
strings /boot/kernel/ntfs.ko | grep -c "malformed index" -> 1
vnconfig -c vn0 /root/ntfs_0791.img
mount_ntfs -o ro /dev/vn0 /mnt/ntfs        -> MOUNT_RC=0
stat /mnt/ntfs/a                            -> HANG (120s timeout), guest DOWN

Result: panic: lockmgr: locking against itself at ntfs_ntlookupfile+0x57
(0xffffffff82604ab7 = 0x4a60+0x57, the patched function). The sibling lockmgr
self-lock fires at the SAME early point (inlined ntfs_ntget) on the patched
kernel as on the unpatched kernel, so the dive is still sibling-blocked and the
DF-0791 bounds check is not exercised live. Validated instead via the
deterministic harness (run.log: oob SIGSEGV -> EINVAL with the fix) + the
disassembly in fix_build.log confirming the check is compiled in before the cn
read.

(3 patched attempts: all panicked at +0x57 before the dive; the dive is reliably
sibling-blocked on this guest. A clean-image lookup does not panic, confirming the
self-lock is a separate malformed-image/node-state directory-lookup defect.)