HAMMER2 ZLIB: Fatal error during decompression.
DF-0842: harness start -- about to call z_inflateInit_ (state->window will be NULL, wsize=0)
DF-0842: inflateInit_ ret=0 (expect 0=Z_OK); now calling z_inflate(Z_FINISH) on a 20-byte truncated stream
DF-0842: z_inflate returned -5 (NO PANIC -- window was allocated; bug is absent/fixed). avail_out=6384 total_out=1808

================================================================================
REAL UNPRIVILEGED TRIGGER on PATCHED #1 kernel (same crafted HAMMER2 image)
================================================================================
$ ssh dfbsd-maxx "cat /h2mnt/zd/big.bin > /dev/null; echo CAT_EXIT=$?"
CAT_EXIT=0
SSH_RC=0, guest stays UP, boot.log grows by 0 panic lines.

dmesg (graceful handling instead of panic):
  HAMMER2 ZLIB: Fatal error during decompression.

Interpretation: with the fix, updatewindow() kmalloc()s the window, inflate runs
to completion-of-input (returns Z_OK / Z_BUF_ERROR, NOT Z_STREAM_END because the
crafted stream decompresses past avail_out). The caller detects ret !=
Z_STREAM_END at hammer2_strategy.c:258, prints the decompression error, bzeros
the buffer, and returns -- no NULL deref, no panic. The malformed block yields a
read error handled in-band, exactly as a hardened kernel should.