DF-0844 dirhash OOB harness
  pagesize      = 4096
  entry offset  = 4088 (page-relative)
  chunk offset  = 504
  max d_reclen  = 8 (DIRBLKSIZ - chunk_off)
  crafted entry: d_ino=1 d_reclen=8 d_type=8 d_namlen=255
  DIRSIZ(ep)    = 264  (d_reclen 8 < DIRSIZ → MALFORMED)
  d_name starts at offset 4096 = GUARD PAGE BOUNDARY
  mode          = BUGGY (no DIRSIZ check)

Processing entry (replicating ufsdirhash_build loop)...
RESULT: *** OOB READ CONFIRMED ***
        fnv_32_buf(ep->d_name, 255) read past the buffer into the guard page.
        The missing d_reclen >= DIRSIZ(ep) check allowed a 255-byte
        out-of-bounds read from the entry's d_name field.
        In the kernel this reads 255 bytes of adjacent kernel heap.
EXIT=0

DF-0844 dirhash OOB harness
  pagesize      = 4096
  entry offset  = 4088 (page-relative)
  chunk offset  = 504
  max d_reclen  = 8 (DIRBLKSIZ - chunk_off)
  crafted entry: d_ino=1 d_reclen=8 d_type=8 d_namlen=255
  DIRSIZ(ep)    = 264  (d_reclen 8 < DIRSIZ → MALFORMED)
  d_name starts at offset 4096 = GUARD PAGE BOUNDARY
  mode          = FIXED (with DIRSIZ check)

Processing entry (replicating ufsdirhash_build loop)...
RESULT: Entry REJECTED by bounds check (this is the FIX behavior).
        The malformed entry was correctly detected and rejected.
        No OOB read occurred.
EXIT=0