=== DF-0865 BASELINE PANIC (unpatched #0 kernel, original hpfs.ko) ===
Trigger: stat("/mnt/hpfs") as unpriv user maxx -> VOP_GETATTR -> hpfs_getattr
         (hpfs_vnops.c:467) -> hpfs_validateparent -> dep-walk OOB.

From dfbsd-qemu/boot.log (lines 220-237):

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address    = 0xfffff80057f97116
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff826032f6
stack pointer            = 0x10:0xfffff801184e35c8
frame pointer            = 0x10:0xfffff801184e3618
code segment             = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags         = interrupt enabled, resume, IOPL = 0
current process          = 963
current thread           = pri 6
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      hpfs_validateparent+0x146:      movzwl  0x2(%r15),%edx
db>

Analysis:
- The faulting instruction `movzwl 0x2(%r15),%edx` reads dep->de_flag
  (offset +2 in struct hpfsdirent) from the dep pointer in r15.
- The dep pointer walked 276 bytes past the 2 KB (D_BSIZE=2048) bread
  buffer (dep started at bp->b_data+20, advanced by de_reclen=0x0900 to
  bp->b_data+2324). The page at that OOB address is unmapped -> page fault.
- This is exactly DF-0865's cited path: hpfs_validateparent dep-walk in
  sys/vfs/hpfs/hpfs_subr.c:598-613 (while loop + post-loop de_flag read),
  no bound check against the bread buffer.