=== DF-0861 Phase 8: PATCHED hpfs.ko module validation ===
Baseline kernel: DragonFly 6.5-DEVELOPMENT #0 (with-src, INVARIANTS ON)
Patched module:  /boot/kernel/hpfs.ko
                  sha256 01434d8ffb77c5963649a3236f117e79535ccb39369e76d566987875c892cb65
                  (rebuilt from /usr/src/sys/vfs/hpfs after applying fix.diff)
Hot-swap:        kldunload hpfs (id 4) -> kldload hpfs (id 5)

--- AFTER test 1: df861.img (sp_cpinum=1, s_cpicnt=0x1F) on PATCHED module ---
mounted /dev/vn1 on /mnt/test861 (RO)
mount_rc=0
umount_rc=0

Result: mount SUCCEEDS cleanly; with the fix the inner loop runs only
`min(s_cpicnt, cpicnt)=1` iteration (one in-bounds cpdblk write), so there
is NO 4080-byte OOB write and NO slab corruption. Guest stays UP.

--- AFTER test 2: 3x mount/unmount cycles on PATCHED module (no corruption) ---
mounted /dev/vn1 on /mnt/test861 (RO)
cycle 1 rc=0
mounted /dev/vn1 on /mnt/test861 (RO)
cycle 2 rc=0
mounted /dev/vn1 on /mnt/test861 (RO)
cycle 3 rc=0
ALL_CYCLES_DONE

Result: all 3 cycles succeed; guest stays UP throughout. Compare to the
unpatched module where run 1 panicked in kqueue_register from the slab
corruption cascade.

--- AFTER test 3: EINVAL gate — df861-huge.img (sp_cpinum=1000) on PATCHED module ---
mount_hpfs_simple: mount(hpfs, /dev/vn1, /mnt/test861): Invalid argument
huge_mount_rc=1
--- dmesg ---
hpfs_cpinit: forged sp_cpinum 1000 > max 256
hpfs_cpinit: forged sp_cpinum 1000 > max 256

Result: forged sp_cpinum=1000 is REJECTED at the new validation gate
(HPFS_SP_CPINUM_MAX=256) with EINVAL; dmesg shows:
  hpfs_cpinit: forged sp_cpinum 1000 > max 256
No kmalloc, no inner loop, no OOB write. Guest stays UP.

=== BEFORE/AFTER SUMMARY ===
BEFORE (unpatched hpfs.ko):  mount df861.img -> 4080-byte heap OOB write
                              (harness DF_0861_BUG_CONFIRMED=1, OOB=4080);
                              slab corruption -> panic in kqueue_register
                              (Fatal trap 9, run 1). Guest DOWN.
AFTER  (patched  hpfs.ko):   mount df861.img -> clean (1 in-bounds write);
                              3 cycles OK, guest UP. Forged sp_cpinum=1000
                              -> EINVAL rejected at the gate. Guest UP.
FIX CLOSES THE BUG.