=== DF-0808 dirfs_nrename missing-NULL-check analysis ===

Bug: sys/vfs/dirfs/dirfs_vnops.c:977-981 — tpath/fpath from
     dirfs_node_absolute_path_plus() passed to rename() with NO
     NULL check. Finding claims: 'rename(NULL,...) derefs NULL = panic'

--- Part 1: dirfs_node_absolute_path_plus returns NULL for over-length paths ---

  Short path test:
    dm_path="/mnt/dirfs", dir="subdir", name="myfile.txt"
    result: /mnt/dirfs/subdir/myfile.txt (pathfree=0x8004a9100)

  Over-length path test (5 dirs * 200 chars + mount path > MAXPATHLEN):
    tpath = NULL  <-- over-length, returns NULL
    fpath = NULL  <-- over-length, returns NULL
    => dirfs_node_absolute_path_plus CAN return NULL (CONFIRMED)

--- Part 2: live rename(NULL, ...) call — crash or EFAULT? ---

  rename(NULL, "/tmp/df0808_dst"):
    return value: -1
    errno:        14 (Bad address)
    => NO CRASH.  Returns EFAULT (kernel copyinstr catches NULL).

  rename("/tmp/df0808_testfile", NULL):
    return value: -1, errno: 14 (Bad address)
    => NO CRASH.  Returns EFAULT.

  rename(NULL, NULL):
    return value: -1, errno: 14 (Bad address)
    => NO CRASH.  Returns EFAULT.

--- Part 3: dirfs_nrename transcription (over-length path scenario) ---

  VULNERABLE dirfs_nrename (no NULL check, lines 977-981):
    returned error: 14 (Bad address)
    => EFAULT (wrong error; should be ENAMETOOLONG), but NO PANIC

  FIXED dirfs_nrename (NULL check -> ENAMETOOLONG):
    returned error: 63 (File name too long)
    => ENAMETOOLONG (correct POSIX error)

--- Part 4: unlinked-parent scenario (dnp1==NULL after loop) ---

  Unlinked parent test:
    dirfs_node_absolute_path_plus returns: NULL  <-- parent chain broken, returns NULL
    => rename(NULL,...) would return EFAULT (not panic)

=== SUMMARY ===
1. dirfs_node_absolute_path_plus CAN return NULL (over-length path or
   unlinked parent) — CONFIRMED by faithful code transcription.
2. dirfs_nrename does NOT check for NULL before calling rename() — CONFIRMED.
3. rename(NULL,...) returns EFAULT (errno 14), NOT a segfault/panic —
   PROVEN by live call on the guest kernel.
4. The finding's claim of 'NULL deref panic' is a FALSE POSITIVE.
   Actual impact: rename returns EFAULT instead of ENAMETOOLONG
   (POSIX correctness bug, not a security panic/DoS).
5. The fix (NULL check -> ENAMETOOLONG) is still correct for robustness.
RUN_EXIT=0