=== DF-0806 dirfs_readlink off-by-one harness ===
Transcription of sys/vfs/dirfs/dirfs_vnops.c:1328-1334
Guard-page allocator detects any access to buf[N].

[kmalloc-16 bucket] N=16
  VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
    line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
    line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
  FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
    buf[nlen]='\0'            : no fault (in-bounds)
    uiomove(buf,N)             : no fault (in-bounds)
  => BUG PRESENT (OOB detected); FIX VALID (no OOB)

[kmalloc-32 bucket] N=32
  VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
    line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
    line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
  FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
    buf[nlen]='\0'            : no fault (in-bounds)
    uiomove(buf,N)             : no fault (in-bounds)
  => BUG PRESENT (OOB detected); FIX VALID (no OOB)

[kmalloc-64 bucket] N=64
  VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
    line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
    line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
  FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
    buf[nlen]='\0'            : no fault (in-bounds)
    uiomove(buf,N)             : no fault (in-bounds)
  => BUG PRESENT (OOB detected); FIX VALID (no OOB)

[kmalloc-128 bucket] N=128
  VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
    line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
    line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
  FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
    buf[nlen]='\0'            : no fault (in-bounds)
    uiomove(buf,N)             : no fault (in-bounds)
  => BUG PRESENT (OOB detected); FIX VALID (no OOB)

[kmalloc-256 bucket] N=256
  VULNERABLE dirfs_readlink transcription (kmalloc(N), nlen=N):
    line 1334 buf[nlen]='\0'  : FAULT (1-byte heap overflow / OOB WRITE confirmed)
    line 1333 uiomove(buf,N+1) : FAULT (1-byte OOB READ confirmed)
  FIXED transcription (kmalloc(N+1), uiomove(buf,nlen)):
    buf[nlen]='\0'            : no fault (in-bounds)
    uiomove(buf,N)             : no fault (in-bounds)
  => BUG PRESENT (OOB detected); FIX VALID (no OOB)

=== SUMMARY ===
Vulnerable code: 1-byte OOB WRITE at buf[N] (CWE-787) AND
                  1-byte OOB READ via uiomove(buf,N+1) (CWE-125)
Fixed code:       no OOB (kmalloc(N+1) + uiomove(buf,nlen))
Overall: BUG CONFIRMED + FIX VALIDATED
RUN_EXIT=0