# DF-0810 — nfs_getcookie() OOB array index via int truncation

## Summary

`nfs_getcookie()` (sys/vfs/nfs/nfs_subs.c:1341) computes a cookie array
index by truncating a 64-bit directory offset quotient to `int`. A large
seek offset on an NFS directory causes a wild pointer dereference → kernel panic.

## Build

```
./build.sh
```

## Run (requires NFS setup)

Prerequisites (root setup, acceptable per audit realism test):
```sh
service rpcbind onestart
service mountd onestart
service nfsd onestart
echo "/nfsroot -maproot=root -network 127.0.0.0 -mask 255.0.0.0" > /etc/exports
mkdir -p /nfsroot/bigdir
(cd /nfsroot/bigdir && i=1; while [ $i -le 500 ]; do touch f$i; i=$((i+1)); done)
chown -R maxx:maxx /nfsroot/bigdir
mount_nfs -3 127.0.0.1:/nfsroot /mnt
# Do NOT ls /mnt/bigdir — that would set n_direofoffset and block the trigger
```

Run as maxx:
```
./run.sh
```

## Expected behavior

- **Unpatched kernel (#0)**: kernel panic — `Fatal trap 12: page fault`
  in `nfs_readdirrpc_uio+0xa4`. Guest dies.
- **Patched kernel (#1)**: `getdents` returns 0, guest stays up. No panic.