DF-0877 — panic signature
==========================

No kernel panic observed during in-kernel reproduction on this heap layout.
The OOB read of 524312 bytes walks through adjacent MAPPED buffer-cache
pages without hitting an unmapped page, so no page fault occurs. This is
the info-leak manifestation (same as DF-0876): the read is silent.

The deterministic harness (harness.c CASE C) proves the read WILL page-fault
when the adjacent memory is unmapped:

  [!] SIGSEGV during dx_csum OOB read at addr 0x0000000800474000

On a production kernel with different heap layout (or a smaller buffer cache),
the 520KB over-read crosses an unmapped page and panics. Both outcomes
(info-leak and panic) are valid manifestations of the same OOB read bug.

The in-kernel evidence is:
  - mount_ext2fs succeeds (image is structurally valid, all metadata csums OK)
  - ls /mnt/t1/testdir (as unprivileged uid=1001) returns EIO:
      "ls: /mnt/t1/testdir/: Input/output error"
    This EIO comes from ext2_dx_csum_verify returning EIO (csum mismatch),
    which proves the dx_csum path ran — and the 524312-byte OOB read at
    ext2_csum.c:261 happened BEFORE the csum comparison at :289.