BUILD_EXIT=0
=== DF-0821 harness: hammer2_freemap.c:616-803 linear-iterator OOB ===

--- [1] Control: normal positive linear (8192 = 0x2000), radix=10 (1KB) ---
linear=0x00002000 (int32=8192) size=1024 bmradix=2
  guard1 ((uint32)linear & MASK) + size <= BLOCK_SIZE : PASS  (0x2000 + 1024 = 9216 <= 16384)
  guard2 (linear & MASK) nonzero                    : PASS  (0x2000)
  guard3 (int32 linear < SEGSIZE)                   : PASS  (8192 < 4194304)
  => linear-iterator path TAKEN: YES (BUG)
  offset = linear          = 8192
  i = offset / 524288          = 0   (SEGSIZE/BMAP_ELEMENTS)
  j = (offset / 8192) & 62   = 0

--- [2] Control: block-aligned linear (16384 = 0x4000), radix=14 (16KB) ---
linear=0x00004000 (int32=16384) size=16384 bmradix=2
  guard1 ((uint32)linear & MASK) + size <= BLOCK_SIZE : PASS  (0x0 + 16384 = 16384 <= 16384)
  guard2 (linear & MASK) nonzero                    : fail  (0x0)
  guard3 (int32 linear < SEGSIZE)                   : PASS  (16384 < 4194304)
  => linear-iterator path TAKEN: no (bitmap scan)

--- [3] BUG: negative linear 0x80001000 (int32 -2147479552), radix=10 ---
    This is the DF-0821 trigger: passes all 3 guards, OOB index i=-4095.
linear=0x80001000 (int32=-2147479552) size=1024 bmradix=2
  guard1 ((uint32)linear & MASK) + size <= BLOCK_SIZE : PASS  (0x1000 + 1024 = 5120 <= 16384)
  guard2 (linear & MASK) nonzero                    : PASS  (0x1000)
  guard3 (int32 linear < SEGSIZE)                   : PASS  (-2147479552 < 4194304)
  => linear-iterator path TAKEN: YES (BUG)
  [GENERIC] KKASSERT(bmap->linear >= 0) would PANIC here (line 631-633)
  [noinv]   KKASSERT compiled out; continuing to OOB array index...
  offset = linear          = -2147479552
  i = offset / 524288          = -4095   (SEGSIZE/BMAP_ELEMENTS)
  j = (offset / 8192) & 62   = 0
  *** OOB ARRAY INDEX: bitmapq[-4095] is 32760 bytes BEFORE bitmapq[0] ***
  [noinv] simulating OOB READ at :727 (bmap->bitmapq[i] & bmmask == 0):
          bitmapq[-4095] @ bitmapq[0] + -32760 bytes = 0xcdcdcdcdcdcdcdcd
          bmmask = 0x0000000000000003
          (bitmapq[i] & bmmask) == 0  -> FALSE
  [noinv] simulating OOB WRITE at :803 (bmap->bitmapq[i] |= bmmask):
          wrote 0x0000000000000003 into bitmapq[-4095] @ bitmapq[0] + -32760 bytes
          canary region BEFORE bitmapq[0] modified: YES (OOB write confirmed)

--- [4] BUG variant: negative linear 0xFFFF2000 (int32 -57344), radix=10 ---
    Different negative -> different OOB offset (smaller).
linear=0xffff2000 (int32=-57344) size=1024 bmradix=2
  guard1 ((uint32)linear & MASK) + size <= BLOCK_SIZE : PASS  (0x2000 + 1024 = 9216 <= 16384)
  guard2 (linear & MASK) nonzero                    : PASS  (0x2000)
  guard3 (int32 linear < SEGSIZE)                   : PASS  (-57344 < 4194304)
  => linear-iterator path TAKEN: YES (BUG)
  [GENERIC] KKASSERT(bmap->linear >= 0) would PANIC here (line 631-633)
  [noinv]   KKASSERT compiled out; continuing to OOB array index...
  offset = linear          = -57344
  i = offset / 524288          = 0   (SEGSIZE/BMAP_ELEMENTS)
  j = (offset / 8192) & 62   = 56

=== Impact summary ===
On default GENERIC (INVARIANTS ON): KKASSERT at :631 panics -> DoS.
On INVARIANTS-OFF / production: OOB read at :727/:749/:785, OOB write at :803.
For linear=0x80001000: OOB extent is 32760 bytes BEFORE bitmapq[0] in kernel heap.
RUN_EXIT=0