=== DF-0795 run on UNPATCHED baseline kernel #0 ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

Image: /tmp/df0795.img (16 MB FAT16, root-dir slot 0 patched with
       weCnt=0x54 = WIN_LAST|20 -> id=19, 13 ASCII chars "ABCDEFGHIJKLM",
       followed by SLOT_EMPTY terminator).

[*] vnconfig + mount
vnconfig -c vn0 /tmp/df0795.img
mount -t msdos /dev/vn0 /tmp/df0795_mnt
mount rc=0
[*] mount OK; now ls the root (triggers msdosfs_readdir -> overflow)
---- ls -la ----
total 40
drwxr-xr-x  1 root  wheel  16384 Jan  1  1980 .
drwxrwxrwt  3 root  wheel    528 Jul  5 13:34 ..
---- ls ----
(empty -- no 8.3 alias entry, so reassembled LFN is not emitted)
---- stat ----
stat: /tmp/df0795_mnt/*: stat: Invalid argument
[*] ls done; unmounting
[*] DONE -- no panic, no kernel message.  Overflow was SILENT.

DISPOSITION:
  The bug fired (mbnambuf_write wrote nb_buf[247..259], overflowing nb_buf[256]
  by 4 bytes into dirbuf.d_ino low 4 bytes -- confirmed by deterministic
  harness run_before_fix.log).  No panic because:
    - The DragonFly kernel has NO stack canary (sys/conf/files:2219
      libkern/stack_protector.c is commented out), so no canary check fires.
    - The 4 overflow bytes land in dirbuf.d_ino (low 32 bits), which is
      unconditionally OVERWRITTEN at msdosfs_vnops.c:1684/1694/1698 before
      vop_write_dirent uses it.  See VERDICT.md for the full stack-frame
      disassembly and the byte-by-byte corruption map.
  Guest stayed up, dmesg clean, no escalation primitive corrupted.

=== guest alive after test ===
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64