=== Primary reproduction (initial run, kernel #0 baseline) ===
Trigger:  vnconfig -c vn0 /root/df0803_g0.img
          mount_ext2fs -o ro /dev/vn0 /mnt   (succeeds)
          ls /mnt                            (panics)

Serial console (dfbsd-qemu/boot.log.pre-df0803):
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
Fatal user address access from kernel mode from ls at ffffffff82601960

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0x20
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82601960
stack pointer	        = 0x10:0xfffff801182cb670
frame pointer	        = 0x10:0xfffff801182cb6c8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 0, def32 0, gran 1
processor eflags		= interrupt enabled, resume, IOPL = 0
current process		= 952
kernel: type 12 trap, code=0
CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      e2fs_gd_get_i_tables:   movl    0x28(%rdi),%eax
db>

=== Re-confirmation run (kernel #0 baseline, after Phase 8) ===
Identical signature:
Fatal user address access from kernel mode from ls at ffffffff82601960
fatal-trap 12, fault virtual address 0x20
Stopped at      e2fs_gd_get_i_tables:   movl    0x28(%rdi),%eax

=== Root cause (deterministic, harness) ===
- fs->e2fs_gd was malloc(0) -> ZERO_LENGTH_PTR == (void *)-8
- ext2_vget(EXT2_ROOTINO=2) -> ino_to_cg = 0 -> e2fs_gd[0] = (void*)-8
- e2fs_gd_get_i_tables reads at offset 0x28 within gd -> fault addr -8+0x28 = 0x20