########## BASELINE (unpatched #0): reclen=0 NTFS image, readdir ##########
## image: ntfs_reclen0.img (entry[0] reclen=0, no LAST, ie_number=0x48484848)
## expect: unbounded walk never advances, re-emits entry[0] until uio fills
[+] opened /mnt/t; reading dirents (ntfs_readdir unbounded walk)...
  dirent[0]: d_ino=0x0000000000000005 d_namlen=2 d_type=4 d_name='..'
  dirent[1]: d_ino=0x0000000048484848 d_namlen=4 d_type=8 d_name='HHHH'   <-- SUSPICIOUS d_ino (heap residue?)
  dirent[2]: d_ino=0x0000000048484848 d_namlen=4 d_type=8 d_name='HHHH'   <-- SUSPICIOUS d_ino (heap residue?)
  ... (256 duplicate 'HHHH' dirents) ...
  dirent[254]: d_ino=0x0000000048484848 d_namlen=4 d_type=8 d_name='HHHH'   <-- SUSPICIOUS d_ino (heap residue?)
  dirent[255]: d_ino=0x0000000048484848 d_namlen=4 d_type=8 d_name='HHHH'   <-- SUSPICIOUS d_ino (heap residue?)
  dirent[256]: d_ino=0x0000000048484848 d_namlen=4 d_type=8 d_name='HHHH'   <-- SUSPICIOUS d_ino (heap residue?)
[+] readdir returned 257 entries

########## BASELINE (unpatched #0): reclen=0xFFF0 OOB-leap image ##########
[+] opened /mnt/t; reading dirents (ntfs_readdir unbounded walk)...
  dirent[0]: d_ino=0x0000000000000005 d_namlen=2 d_type=4 d_name='..'
       raw: 050000000000000002000400000000002e2e000000000000
  dirent[1]: d_ino=0x0000000041414141 d_namlen=4 d_type=8 d_name='AAAA'   <-- SUSPICIOUS d_ino (heap residue?)
       raw: 414141410000000004000800000000004141414100000000
[+] readdir returned 2 entries

########## PATCHED ntfs.ko (846888df...): reclen=0 ##########
[+] opened /mnt/t; reading dirents (ntfs_readdir unbounded walk)...
[!] readdir returned 0 entries; errno=22 (Invalid argument)
TRIG_RC=0

########## PATCHED ntfs.ko: reclen=0xFFF0 OOB-leap ##########
[+] opened /mnt/t; reading dirents (ntfs_readdir unbounded walk)...
  dirent[0]: d_ino=0x0000000000000005 d_namlen=2 d_type=4 d_name='..'
  dirent[1]: d_ino=0x0000000041414141 d_namlen=4 d_type=8 d_name='AAAA'
[+] readdir returned 2 entries
TRIG_RC=0
  (entry[0] processed in-bounds; OOB advance to +0xFFF0 PREVENTED by bounds check)

########## PATCHED ntfs.ko: regression on CLEAN image ##########
[+] opened /mnt/t; reading dirents (ntfs_readdir unbounded walk)...
  dirent[0]: d_ino=0x5 d_name='..'
  dirent[1]: d_ino=0x64 d_name='HELLO'
  dirent[2]: d_ino=0x65 d_name='WORLD'
  dirent[3]: d_ino=0x66 d_name='FOO'
[+] readdir returned 4 entries