=== DF-0830 BASELINE PANIC (unpatched #0 kernel + original hpfs.ko) ===
=== Two independent runs, identical crash signature (different buffer addr each boot) ===

--- Run 1 ---
Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xfffff80055487116
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826032f6
stack pointer	        = 0x10:0xfffff801183d72c8
frame pointer	        = 0x10:0xfffff801183d7318
code segment		= base 0x0, limit 0xffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 976
kernel: type 12 trap, code=0
Stopped at      hpfs_validateparent+0x146:      movzwl  0x2(%r15),%edx

--- Run 2 ---
Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0xfffff80058877116
instruction pointer	= 0x8:0xffffffff826032f6
Stopped at      hpfs_validateparent+0x146:      movzwl  0x2(%r15),%edx

Analysis:
- Trap 12 = page fault, supervisor read, page not present.
- Instruction movzwl 0x2(%r15) = zero-extend u16 at r15+2 = reading dep->de_flag.
- r15 = dep pointer that walked 276 bytes past the 2 KB bread(D_BSIZE) buffer.
- hpfs_validateparent (sys/vfs/hpfs/hpfs_subr.c:598) advances dep by
  dep->de_reclen (0x0900, attacker-controlled u16 from crafted dir block)
  with no bounds check → dep exits [bp->b_data, bp->b_data+D_BSIZE).
- The post-loop dep->de_flag read at the OOB address faults because the
  kernel page at that virtual address is not mapped.