DF-0862 — kernel panic signature from dfbsd-qemu/boot.log (unpatched #0 GENERIC kernel,
INVARIANTS ON).  Trigger: mount of crafted HPFS image with su_btotal=0xFFFFC001.

---------------------------------------------------------------------------
vn4: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)


Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xfffffffffffffff8
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82602800
stack pointer	        = 0x10:0xfffff80117ba3270
frame pointer	        = 0x10:0xfffff80117ba32b0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 961
current thread          = pri 6
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      hpfs_bminit+0x230:      movl    (%rax),%edi
db>
---------------------------------------------------------------------------

PROOF THIS IS THE BUG (not an unrelated panic):
  * fault VA 0xfffffffffffffff8 == ZERO_LENGTH_PTR == (void*)-8
    (sys/kern/kern_slaballoc.c:193), the sentinel returned by kmalloc(0)
    (sys/kern/kern_slaballoc.c:888-890).  hpm_dbnum wrapped to 0, so both
    hpmp->hpm_bmind and hpmp->hpm_bitmap became ZERO_LENGTH_PTR.
  * crash site hpfs_bminit+0x230 `movl (%rax),%edi` is the read
    ((u_int32_t *)hpmp->hpm_bitmap)[i] at sys/vfs/hpfs/hpfs_subr.c:159
    inside the `for(i=0;i<su_btotal>>5;i++)` loop at :156.  rax holds the
    ZERO_LENGTH_PTR; the first iteration faults on the non-canonical address.
  * The loop bound su_btotal>>5 = 0xFFFFC001>>5 = 0x07FFFE00 = 134,217,216,
    completely independent of the wrapped hpm_dbnum=0.