BUILD_OK
== DF-0880 primitive harness (heap over-read in udf_vget) ==
bsize (RDSECTOR read) = 2048
fe->l_ea = 0   fe->l_ad = 65535   (uint32_t, unchecked off disk)
size = UDF_FENTRY_SIZE(176) + l_ea(0) + l_ad(65535) = 65711
over-read past bp->b_data = 65711 - 2048 = 63663 bytes (62.2 KB)

--- demonstrating bcopy(bp->b_data, fentry, 65711) over-read ---
(source ends at a PROT_NONE guard page; read should fault at +2048)
  FAULT caught: bcopy of 65711 bytes crossed the 2048-byte source boundary
  -> SIGSEGV/SIGBUS, exactly as the kernel page-faults on the
     unmapped page past bp->b_data.

== PROOF ==
l_ea/l_ad are uint32_t from disk (ecma167-udf.h:348-349), never
validated against bsize between udf_vfsops.c:527 and :530.
With l_ad=0xFFFF: size=65711 from a 2048-byte buffer = 63663-byte heap OVER-READ.
On the kernel this is a page fault in bcopy() -> panic (DoS); any
bytes surviving a non-faulting over-read leak kernel heap into the
file-entry alloc-descriptor area (info leak / CWE-125).