=== DF-0887 primitive characterization ===
i_shortlink buffer size = 48 bytes (di_db[UFS_NDADDR=12])
UFS1_MAXSYMLINKLEN      = 60 bytes
forged di_size          = 4096 bytes
forged di_blocks        = 0
mnt_maxsymlinklen       = 60
fast-path enter (VLNK && (i_size<maxlen || di_blocks==0)) = YES

bzero length            = 4096
first OOB byte (past shortlink) at inode+152
OOB write length        = 4048 bytes (di_size - 48)
OOB past end of struct inode = 4008 bytes (overflow past inode end)

SIMULATED bzero overflow:
  bytes written past shortlink end   = 4048
  bytes written past end of inode    = 4008 (-> adjacent heap/slab)
  zeroed past inode (within slab)    = 4008

RESULT: OOB WRITE of 4048 bytes past the 48-byte i_shortlink buffer.
        Heap corruption into M_FFSNODE slab (and beyond) confirmed.