=== DF-0903 fix-validation run @ 2026-07-07T06:25:59Z ===
Patched kernel: DragonFly 6.5-DEVELOPMENT #1: Tue Jul  7 06:16:07 UTC 2026

--- PoC on PATCHED #1 kernel (expect mount rejected, no panic) ---
=== BUILD craft_img ===
=== BUILD trigger ===
=== CREATE base UFS image (fs_bsize=8192) ===
=== PATCH fs_qbmask -> 0x3FFF ===
BEFORE PATCH:
  fs_bsize    = 8192 (0x2000)
  fs_bmask    = 0xffffe000
  fs_bshift   = 13
  fs_inodefmt = 2 (FS_44INODEFMT=2; >=2 means on-disk qbmask used verbatim)
  fs_qbmask   = 0x0000000000001fff  (~fs_bmask = 0x00001fff)
AFTER PATCH:
  fs_qbmask   = 0x0000000000003fff
  => blkoff(offset) = offset & 0x3fff
  => xfersize = fs_bsize - blkoffset can go NEGATIVE for offset & 0x3fff >= 8192
  demo: write at offset 10240 => blkoffset=10240, xfersize=-2048
wrote img_qbmask3fff.img (4194304 bytes)
-rw-r--r--  1 root  wheel  4194304 Jul  7 06:25 img_qbmask3fff.img
=== MOUNT crafted image RW ===
mount_ufs: /dev/vn0 on /mnt/test: incorrect super block
MOUNT_RC=1
MOUNT FAILED -- no trigger possible

--- Legitimate UFS image still mounts (no regression) ---
LEGIT_MOUNT_OK + write/read test passed