==> creating fresh 2 GiB image
==> newfs_hammer (vol_version 6 so we can crc32 the btree node locally)
==> mounting fresh HAMMER filesystem
==> writing a >= 64 KiB file (forces zone-10 large_data direct I/O path)
==> unmounting so we can corrupt the offline image
==> compiling the corruption tool
==> flipping vol_no byte of every zone-10 leaf entry to 7 (recomputing btree CRC)
image size = 2147483648 bytes (2048 MiB)
  node@0x21088000 elm[5] dataoff=0xa000000022000000 -> 0xa070000022000000 (vol_no 0 -> 7)
  node@0x21088000 elm[6] dataoff=0xa000000022004000 -> 0xa070000022004000 (vol_no 0 -> 7)
  node@0x21088000 elm[7] dataoff=0xa000000022008000 -> 0xa070000022008000 (vol_no 0 -> 7)
  node@0x21088000 elm[8] dataoff=0xa00000002200c000 -> 0xa07000002200c000 (vol_no 0 -> 7)
  node@0x21088000 elm[9] dataoff=0xa000000022010000 -> 0xa070000022010000 (vol_no 0 -> 7)
  node@0x21088000 elm[10] dataoff=0xa000000022014000 -> 0xa070000022014000 (vol_no 0 -> 7)
  node@0x21088000 elm[11] dataoff=0xa000000022018000 -> 0xa070000022018000 (vol_no 0 -> 7)
  node@0x21088000 elm[12] dataoff=0xa00000002201c000 -> 0xa07000002201c000 (vol_no 0 -> 7)
  node@0x21088000 elm[13] dataoff=0xa000000022020000 -> 0xa070000022020000 (vol_no 0 -> 7)
  node@0x21088000 elm[14] dataoff=0xa000000022024000 -> 0xa070000022024000 (vol_no 0 -> 7)
  node@0x21088000 elm[15] dataoff=0xa000000022028000 -> 0xa070000022028000 (vol_no 0 -> 7)
  node@0x21088000 elm[16] dataoff=0xa00000002202c000 -> 0xa07000002202c000 (vol_no 0 -> 7)
  node@0x21088000 elm[17] dataoff=0xa000000022030000 -> 0xa070000022030000 (vol_no 0 -> 7)
  node@0x21088000 elm[18] dataoff=0xa000000022034000 -> 0xa070000022034000 (vol_no 0 -> 7)
  node@0x21088000 elm[19] dataoff=0xa000000022038000 -> 0xa070000022038000 (vol_no 0 -> 7)
  node@0x21088000 elm[20] dataoff=0xa00000002203c000 -> 0xa07000002203c000 (vol_no 0 -> 7)
modified 16 entries in 1 nodes; bad vol_no = 7
==> re-mounting the now-malicious HAMMER image
==> reading the file -- this triggers the NULL deref on the unpatched kernel
    (on a fixed kernel this returns EIO and the guest stays up)
cat: /mnt/htest/testfile: No such file or directory
RUN_RC=1