== DF-0795 ASCII variant (weCnt=0x54, id=19, count=13) ==
mbnambuf_write returned 0 (0 = OK, overflow happened)
nb_buf size     = 256
slot offset     = 19*13 = 247 (writes nb_buf[247..259])
overflow bytes  = nb_buf[256..259] = 4 bytes past end
These 4 bytes land in dirbuf.d_ino low 4 bytes.

  nb_buf[244..259] =            aaaaaa4142434445464748494a4b4c4d
byte-by-byte corruption map:
  nb_buf[256] -> dirbuf byte -4 (dirbuf.d_ino) = 0x4a
  nb_buf[257] -> dirbuf byte -3 (dirbuf.d_ino) = 0x4b
  nb_buf[258] -> dirbuf byte -2 (dirbuf.d_ino) = 0x4c
  nb_buf[259] -> dirbuf byte -1 (dirbuf.d_ino) = 0x4d

Result: dirbuf.d_ino low 32 bits corrupted with 'HIJK' (0x4a4b4849 little-endian).
-> NO control-flow primitive corrupted (no fn ptr, no rbp, no ret addr).
-> In msdosfs_readdir, dirbuf.d_ino is unconditionally OVERWRITTEN
   at msdosfs_vnops.c:1684/1694/1698 before vop_write_dirent, so the
   corruption is discarded.  Bug is real (CWE-787) but contained.

== DF-0795 KICONV variant (weCnt=0x54, id=19, count=26) ==
mbnambuf_write returned 0 (0 = OK, overflow happened)
slot offset = 247, count = 26 -> writes nb_buf[247..272]
overflow bytes = nb_buf[256..272] = 17 bytes past end
These 17 bytes land in:
  dirbuf.d_ino (8), d_namlen (2), d_type (1),
  d_unused1 (1), d_unused2 (4), d_name[0] (1)

  nb_buf[244..271] =            aaaaaa6162636465666768696a6b6c6d6e6f70717273747576777879
  nb_buf[256] -> dirbuf byte -4 (dirbuf.d_ino) = 0x6a
  nb_buf[257] -> dirbuf byte -3 (dirbuf.d_ino) = 0x6b
  nb_buf[258] -> dirbuf byte -2 (dirbuf.d_ino) = 0x6c
  nb_buf[259] -> dirbuf byte -1 (dirbuf.d_ino) = 0x6d
  nb_buf[260] -> dirbuf byte 0 (dirbuf.d_ino) = 0x6e
  nb_buf[261] -> dirbuf byte 1 (dirbuf.d_ino) = 0x6f
  nb_buf[262] -> dirbuf byte 2 (dirbuf.d_ino) = 0x70
  nb_buf[263] -> dirbuf byte 3 (dirbuf.d_ino) = 0x71
  nb_buf[264] -> dirbuf byte 4 (dirbuf.d_ino) = 0x72
  nb_buf[265] -> dirbuf byte 5 (dirbuf.d_ino) = 0x73
  nb_buf[266] -> dirbuf byte 6 (dirbuf.d_ino) = 0x74
  nb_buf[267] -> dirbuf byte 7 (dirbuf.d_ino) = 0x75
  nb_buf[268] -> dirbuf byte 8 (dirbuf.d_namlen) = 0x76
  nb_buf[269] -> dirbuf byte 9 (dirbuf.d_namlen) = 0x77
  nb_buf[270] -> dirbuf byte 10 (dirbuf.d_type) = 0x78
  nb_buf[271] -> dirbuf byte 11 (dirbuf.d_unused1) = 0x79
  nb_buf[272] -> dirbuf byte 12 (dirbuf.d_unused2) = 0x7a

Conclusion: KICONV variant corrupts more of dirbuf but STILL
no control-flow primitive (no fn ptr / rbp / ret addr).
All corrupted dirbuf fields are unconditionally overwritten by
msdosfs_readdir before vop_write_dirent uses them.