=== BASELINE KERNEL kern.version (unpatched, #0) ===
DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

=== BASELINE run: /root/trigger /mnt/df0888/target  (ftruncate to 5 TiB) ===
[root@dfbsd ~]# /root/trigger /mnt/df0888/target
[trigger] opened /mnt/df0888/target, ftruncate -> 5497558138880 (5 TiB)
<<< ssh channel died here: kernel panicked mid-syscall; no "ftruncate returned" line >>>
<<< run_root returned with no output (ssh dropped) >>>

=== guest status immediately after ===
down   (sitting in DDB at the db> prompt)

=== serial console (dfbsd-qemu/boot.log) panic signature ===
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff8007a6673fc
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80bca670
stack pointer	        = 0x10:0xfffff8011836f4f0
frame pointer	        = 0x10:0xfffff8011836f588
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 984
current thread          = pri 6 
kernel: type 12 trap, code=2

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      memset+0xf0:    movq    %r10,(%rdi)
db> 
=== HARNESS (deterministic arithmetic proof) ===
ext2_ind_truncate arithmetic (lines 310-313) with osize=6TiB, length=5TiB:
  lastblock        = 1342177279
  lastiblock[TRIPLE] = 1341127667
  NINDR^3 (max TRIPLE indices) = 1073741824
  lastiblock[TRIPLE] > NINDR^3 ?  YES -> OOB
ext2_indirtrunc(level=TRIPLE):
  factor (NINDR^2) = 1048576
  last = 1278 (> NINDR-1=1023 -> OOB index)
  bzero start: &bap[1279] (bap has 1024 entries -> OOB)
  bzero len = 18446744073709550596 bytes (size_t UNDERFLOW -> heap OOB write)
== RESULT: BUG CONFIRMED -- OOB heap bzero in ext2_indirtrunc ==