=== PATCHED kernel #1 (fix applied) — same PoC (evil.udf, st_size=32768, rt_l=65535) ===
kern.version: DragonFly 6.5-DEVELOPMENT #1: Sat Jul 11 22:11:06 UTC 2026
udf.ko sha256: 3dceb425cfce3f328dec84ee13e2325ec29d8c9828c6b79ac732fcbf7b277b70

Run 1:
  vnconfig -c vn0 /root/evil.udf
  mount -t udf -o rdonly /dev/vn0 /mnt/udf
  => mount_udf: /dev/vn0: Invalid argument
  MOUNT_RC=1
  Guest alive: 10:20PM up 1 min, load averages: 0.08, 0.05, 0.02
  dmesg: "Couldn't find the fsd" (sparing scan bounded, no OOB, no panic)

Run 2:
  vnconfig -u vn0; vnconfig -c vn0 /root/evil.udf
  mount -t udf -o rdonly /dev/vn0 /mnt/udf
  => mount_udf: /dev/vn0: Invalid argument
  MOUNT_RC=1
  Guest alive: 10:20PM up 2 mins

CONCLUSION: Fix closes the bug. rt_l is now bounded by max_entries=(st_size-56)/8.
The sparing-table scan completes within the allocation; no page fault; no panic.
EINVAL is from the intentionally-missing FSD in the test image, NOT from the bug.