=== DF-0867 fix-validation run (single-fix kernel 6.5-DEVELOPMENT #1) ===
Kernel: DragonFly 6.5-DEVELOPMENT #1: Sat Jul 11 18:29:09 UTC 2026
        (same source as #0 baseline + ONLY findings/poc/DF-0867/fix.diff applied:
         rec_type validation switch added to hammer_ioc_mirror_write_rec)
sha256(/boot/kernel/kernel) = 500dc238d46912fd3a4df10ba6d94a13a6aef225593115a34b721242194e97cc

Command (identical to baseline): ./trigger /mnt/df0867/target

=== PATCHED RUN #1 ===
[*] issuing HAMMERIOC_MIRROR_WRITE on /mnt/df0867/target (rec_type=0x0002 data_len=16)
[*] expected: kernel panic 'rec_type 0002 unknown' in hammer_alloc_data
[!] ioctl returned (no panic): head.error=22
RC=0
ssh exit = 0 ; vm.sh status => up   (guest healthy, no panic)

=== PATCHED RUN #2 (determinism) ===
[*] issuing HAMMERIOC_MIRROR_WRITE on /mnt/df0867/target (rec_type=0x0002 data_len=16)
[*] expected: kernel panic 'rec_type 0002 unknown' in hammer_alloc_data
[!] ioctl returned (no panic): head.error=22
RC=0
ssh exit = 0 ; vm.sh status => up

head.error=22 is EINVAL — the new rec_type validation in hammer_ioc_mirror_write_rec
returns EINVAL for the unhandled rec_type=0x0002 BEFORE the record reaches
hammer_create_at_cursor()/hammer_alloc_data(). No panic.

BEFORE/AFTER CONTRAST:
  unpatched #0 : panic "hammer_alloc_data: rec_type 0002 unknown" (guest dies)
  patched   #1 : ioctl returns EINVAL, guest stays up   => FIX CLOSES THE BUG.