BUILD_EXIT=0
=== DF-0811 divisor-bug harness ===
geometry: bsize=4096 first_dblock=0 bpg=32768 (== bsize*8 mount invariant)
target cg=1, FLEX_BG=1
attacker group-1 b_bitmap pointer = 4096 (physically in group 0)

BUGGY  ext2_block_in_group(tmp=4096, cg=1) = 1
  (buggy ext2_get_group_number = (4096-0)/4096 = 1)
CORRECT ext2_block_in_group(tmp=4096, cg=1) = 0
  (correct group number        = (4096-0)/32768 = 0)

--- setbit index math (ext2_alloc.c:888-895) ---
start           = cg*bpg + first_dblock = 1*32768 + 0 = 32768
bit_index       = tmp - start           = 4096 - 32768 = 18446744073709522944 (0xffffffffffff9000)
byte_index      = bit_index / NBBY      = 2305843009213690368 (0x1ffffffffffff200)
bp->b_data size = bsize                 = 4096 bytes

*** BUG TRIGGERED: setbit(bp->b_data[+2305843009213690368], ...) writes 2305843009213686272 bytes
    PAST the 4096-byte block-bitmap buffer => wild kernel heap write.

--- demonstrating the wild write into a guard-paged buffer ---
bp->b_data stand-in = 0x80047c000 (4096 bytes valid, guard page at 0x80047d000)
RESULT: write to bp->b_data[+2305843009213690368] (addr 0x0) FAULTED (SIGSEGV/SIGBUS)
        => the kernel write is 2305843009213686272 bytes beyond the 4096-byte buffer.
        => confirmed out-of-bounds kernel heap write primitive.
RUN_EXIT=0