DF-0861 live-mount OOB-write panic signature (dfbsd-qemu/boot.log)
==================================================================
Trigger:  mount_hpfs_simple /dev/vn1 /mnt/test861
          (mounts crafted df861.img: sp_cpinum=1, cpisec.s_cpicnt=0x1F)
Result:   mount returns 0 (cpinit completes), THEN the 4080-byte heap OOB
          write from hpfs_cpinit has corrupted a neighbouring slab object;
          a subsequent kernel operation (kqueue_register) dereferences the
          corrupted pointer and takes a #GP fault -> kernel panic.

Fatal trap 9: general protection fault while in kernel mode
instruction pointer	= 0x8:0xffffffff8063b1c6
current process		= 996
kernel: type 9 trap, code=0
Stopped at      kqueue_register+0x526:  movq    (%r15),%rdx
db>