=== DF-0873 Phase-8 fix validation (patched ntfs.ko hot-swap) ===
Kernel: DragonFly 6.5-DEVELOPMENT #0 (same GENERIC baseline)
Module: patched /boot/kernel/ntfs.ko (sha256 7d196d3c...) hot-swapped over
        the unpatched original (sha256 aa8d8384...).
Trigger: same escalation image (ntfs_escalate.img, ie_fnamelen=255 all-wide,
         designed to place 0x1337000 at convname[312..319]) + same exploit
         binary as the successful uid0 run.

--- patched-kernel run ---
MOUNTED
[*] PATCHED-kernel exploit run (expect NO uid0):
[*] shellcode @ 0x1337000 (len 4096), win @ 0x405000, ustack @ 0x1400000
[*] opened /mnt/evil fd=3; getdents(64) -> ntfs_readdir overflow...
[*] getdents returned 24; uid=1001           <-- NORMAL return, still uid 1001
EXPLOIT_RC=0                                  <-- main() exit, NOT win() (ret not hijacked)
[*] root marker (expect NONE):
cat: /tmp/DF0873_ROOT: No such file or directory   <-- NO root marker
[*] up:
12:35PM  up 9 mins, 0 users, load averages: 0.00, 0.00, 0.00   <-- guest STABLE

=== BEFORE / AFTER contrast ===
BEFORE (unpatched #0):
   EXPLOIT_RC=0 (win's _exit(getuid())=0); /tmp/DF0873_ROOT = "DF0873 uid=0"
   owned by root:wheel  =>  uid=0 ACHIEVED.
AFTER (patched ntfs.ko):
   getdents returned 24 (normal dirent copy, no overflow); uid=1001; no marker
   => overflow PREVENTED, no privilege change.

=> fix.diff CLOSES THE BUG (j is bounded to sizeof(convname)-1 in the loop;
   the wide write is skipped when j would overflow; convname is always
   NUL-terminated within bounds).