harness.c: In function 'main':
harness.c:139:36: warning: iteration 64 invokes undefined behavior [-Waggressive-loop-optimizations]
                 if (varr[1].ad_name[k] != (char)0x5A) cor++;
                     ~~~~~~~~~~~~~~~^~~
harness.c:138:13: note: within this loop
             for (int k = 0; k < 72; k++)
             ^~~
=== BUGGY num=1 ===
[harness] DF-0871 ntfs_mountfs $AttrDef OOB-write transcription (v2)
[harness] num entries                = 1
[harness] kmalloc size (num*72)      = 72  -> dest char ad_name[64] each
[harness] source: 256 non-zero wchars + final NUL -> do/while is unbounded
[harness] BUG: do { dest[j]=src[j]; } while(src[j++])  with NO bound on j
[harness] victim array at 0x80047cfb8 (last 72 B of a page; next page PROT_NONE)
[harness] running buggy do/while on entry[0] (last) into guarded array...
[harness] SIGSEGV caught -> do/while wrote PAST the 72-byte allocation.
[harness] PROOF (deterministic): the unbounded copy at
[harness]   ntfs_vfsops.c:458-460 writes dest[j] for j>=72, i.e. past the
[harness]   72-byte ntvattrdef object.  On the live kernel this is a heap
[harness]   OOB write into the M_NTFSMNT slab zone (kmalloc-128/256 bucket).
exit=0
=== BUGGY num=2 ===
[harness] DF-0871 ntfs_mountfs $AttrDef OOB-write transcription (v2)
[harness] num entries                = 2
[harness] kmalloc size (num*72)      = 144  -> dest char ad_name[64] each
[harness] source: 256 non-zero wchars + final NUL -> do/while is unbounded
[harness] BUG: do { dest[j]=src[j]; } while(src[j++])  with NO bound on j
[harness] victim array at 0x80047cf70 (last 144 B of a page; next page PROT_NONE)
[harness] cross-entry demo: entry[0]'s do/while overwrote 72 byte(s) of entry[1].ad_name before its NUL stop (j~255).
[harness] running buggy do/while on entry[1] (last) into guarded array...
[harness] SIGSEGV caught -> do/while wrote PAST the 144-byte allocation.
[harness] PROOF (deterministic): the unbounded copy at
[harness]   ntfs_vfsops.c:458-460 writes dest[j] for j>=72, i.e. past the
[harness]   72-byte ntvattrdef object.  On the live kernel this is a heap
[harness]   OOB write into the M_NTFSMNT slab zone (kmalloc-128/256 bucket).
exit=0
=== FIXED num=1 ===
[harness_fixed] DF-0871 fixed (bounded do/while, NUL-terminated)
[harness_fixed] num=1  allocsz=72  copy completed with NO overflow.
[harness_fixed] entry[0].ad_namelen = 63 (capped at 63)
[harness_fixed] entry[0].ad_name[63] = 0x00 (NUL-terminated)
[harness_fixed] bytes written past entry[0] object = 0 (expect 0)
exit=0
=== FIXED num=2 ===
[harness_fixed] DF-0871 fixed (bounded do/while, NUL-terminated)
[harness_fixed] num=2  allocsz=144  copy completed with NO overflow.
[harness_fixed] entry[0].ad_namelen = 63 (capped at 63)
[harness_fixed] entry[0].ad_name[63] = 0x00 (NUL-terminated)
[harness_fixed] bytes written past entry[0] object = 0 (expect 0)
exit=0