=== BEFORE / AFTER CONTRAST (DF-0852 fix validation) ===

Kernel under test: DragonFly 6.5-DEVELOPMENT x86_64 (X86_64_GENERIC)

------------------------------------------------------------
[BEFORE] UNPATCHED baseline  kern.version = 6.5-DEVELOPMENT #0 (Thu Jul  2 06:02:54 UTC 2026)
         sys/vfs/isofs/cd9660/cd9660_vfsops.c: no ssector validation
------------------------------------------------------------
Trigger: crafted ISO (PVD volume_space_size = 0x7FFFFFF0) mounted via mount(2) with ssector=16
         -> iso_mountfs() line 427: isomp->volume_space_size += argp->ssector
            0x7FFFFFF0 + 16 = 0x80000000  (signed int overflow -> INT_MIN, -fwrapv/-fno-strict-overflow wrap)

$ ./poc /dev/vn0 /tmp/df0852_mnt 16
[poc] mount() rc=0 errno=2 (No such file or directory)
[poc] statfs f_blocks = -2147483648  (0xffffffff80000000)  f_bsize=2048
[poc] !!! BOGUS f_blocks: signed-integer overflow confirmed !!!
                                                 ^^^^^ mount SUCCEEDED; volume_space_size poisoned

Loop-overflow variant (ssector=INT_MAX):
[poc] 16+ssector=-2147483633   100+ssector=-2147483549     <- loop bounds wrapped negative (UB)
[poc] mount() rc=-1 errno=22 (Invalid argument)            <- accepted ssector, overflowed, failed later

------------------------------------------------------------
[AFTER]  PATCHED single-fix kernel  kern.version = 6.5-DEVELOPMENT #1 (Tue Jul 14 03:56:01 UTC 2026)
         fix.diff applied: validate ssector (line ~336) + guard volume_space_size += ssector (line ~449)
------------------------------------------------------------
Same trigger: crafted ISO (VSS=0x7FFFFFF0), ssector=16
$ ./poc /dev/vn0 /tmp/df0852_mnt 16
[poc] mount() rc=-1 errno=22 (Invalid argument)             <- REJECTED by VSS+ssector overflow guard
[poc] mount failed                                          <- NO bogus f_blocks, NO poisoned state
(run #2 identical)

Loop-overflow variant (ssector=INT_MAX):
[poc] mount() rc=-1 errno=22 (Invalid argument)             <- REJECTED by ssector range guard (line 336)

Regression check (normal ISO, VSS=100, ssector=0):
[poc] mount() rc=0 errno=2 ...
[poc] statfs f_blocks = 100  (0x64)  f_bsize=2048           <- normal mounts still work, f_blocks correct
[poc] f_blocks looks normal (no overflow on this path)

------------------------------------------------------------
VERDICT: fix_status = fixed
  - baseline reproduced the signed-integer overflow (bogus f_blocks=-2147483648).
  - patched kernel rejects both the VSS+ssector overflow and out-of-range ssector with EINVAL.
  - no regression: normal mounts succeed with correct f_blocks.
------------------------------------------------------------