DF-0803 — fix-validation run log (Phase 8)
==========================================
Patched kernel: DragonFly 6.5-DEVELOPMENT #1: Sun Jul  5 15:52:17 UTC 2026
                (built from with-src @ commit, + DF-0803 fix.diff)
Patched module: /boot/kernel/ext2fs.ko rebuilt by nativekernel (sha256 856dd655...)

=== TEST 1: gcount=0 image (was panic on baseline #0) ===
vnconfig -c vn0 /root/df0803_g0.img
mount_ext2fs -o ro /dev/vn0 /mnt
mount_ext2fs: /dev/vn0: Invalid argument
MOUNT_EXIT=71

(gcount=0 now rejected at ext2_compute_sb_data by the new "gcount64 == 0"
guard before the broken narrowing assignment. No panic, no e2fs_gd deref.)

=== TEST 2: gcount=1 image (was silent mount, only GD[0] validated on baseline) ===
vnconfig -c vn0 /root/df0803_g1.img
mount_ext2fs -o ro /dev/vn0 /mnt
mount_ext2fs: /dev/vn0: Invalid argument
MOUNT_EXIT=71

(gcount=1 corresponds to true howmany = 2^32 + 1, which now exceeds the
2^32 - DESC_PER_BLOCK limit and is rejected by the fixed post-truncation
check. No panic. No silent mount.)

=== TEST 3: regression — normal ext2 image (built with mke2fs defaults) ===
vnconfig -c vn0 /root/normal_ext2.img
mount_ext2fs -o ro /dev/vn0 /mnt
MOUNT_EXIT=0
ls /mnt
lost+found
umount /mnt   (succeeded)

(Normal filesystems still mount cleanly — fix has no regression on the
happy path. The gcount64 check only rejects values that the original
truncating code silently corrupted.)

=== dmesg after fix tests ===
ext2_mountfs: trying to free NULL pointer   (x4)
(This pre-existing message comes from the error-cleanup path in
ext2_mountfs `goto out` when compute_sb_data returns EINVAL; it is
unrelated to the fix and was present on the baseline too. No new
warnings, no panics, no slab assertions.)

=== Verdict ===
FIXED. Both gcount=0 and gcount=1 (which triggered panic / silent
unvalidated-GD mount respectively on the unpatched #0 baseline) are
now rejected with EINVAL BEFORE the e2fs_gd allocation/deref path is
reached. A normal ext2 image still mounts cleanly. The fix is minimal
and correct.