DF-0873 -- kernel panic from the all-wide (ie_fnamelen=255, all wchar=0x0080)
image, triggered by `ls`/getdents on the mounted crafted NTFS root dir on the
DEFAULT GENERIC #0 kernel (INVARIANTS ON, no stack canary).

The convname loop overflows 255 bytes past the 256-byte buffer, smashing
saved rbx/r12/r13/r14/r15, saved rbp AND the return address.  The smashed
return address 0x80FF80FF80FF80FF (the FF 80 FF 80 ... byte pattern written
by the loop) is visible in the backtrace, and the destroyed stack causes a
double fault.

--- dfbsd-qemu/boot.log excerpt (kernel #0) ---
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
panic: ntfs_readdir: unexpected uio from NFS server
cpuid = 0
Trace beginning at frame 0xfffff80118333638
ntfs_readdir() at ntfs_readdir+0x3c3 0xffffffff82601b33
ntfs_readdir() at ntfs_readdir+0x3c3 0xffffffff82601b33
(null)() at -0x7f007f007f0080 0xff80ff80ff80ff80      <-- SMASHED RET ADDR

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; lapic id = 0
instruction pointer	= 0x8:0xffffffff80bccb70
stack pointer	        = 0x10:0xfffff80118333480
frame pointer	        = 0x10:0xfffff801183334a8
...
DOUBLE FAULT

Fatal double fault
rip = 0xffffffff80bcb71f
rsp = 0x0
rbp = 0x0
cpuid = 0; lapic id = 0
panic: double fault
cpuid = 0
Debugger("panic")
...
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

(The "unexpected uio from NFS server" string is the cookies-path panic at
ntfs_vnops.c:631 -- it fires here because the full j=510 overflow also
corrupts the caller's a_ncookies field to a non-NULL value, entering the
cookies block; the deeper point is the stack is already destroyed: the
backtrace shows the smashed return address 0xff80ff80ff80ff80 and the
double fault with rsp=0/rbp=0 from the destroyed frame.)