=== UNPATCHED BASELINE (DragonFly 6.5-DEVELOPMENT #0 hpfs.ko) ===

--- Variant A (de_reclen=0xFFFF OOB): PANIC ---
[image: df0927_oob.img mounted at /mnt/df0927]
$ stat /mnt/df0927/zzz   # as unprivileged user maxx
[guest down -- serial-console panic signature (from boot.log):]

Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80058e36015
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff826032f6
stack pointer	        = 0x10:0xfffff8011800f3d8
frame pointer	        = 0x10:0xfffff8011800f428
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 910
current thread          = pri 6 
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      hpfs_validateparent+0x146:      movzwl  0x2(%r15),%edx
db> 

--- Variant B (de_reclen=0 spin): HARD HANG ---
[image: df0927_hang1.img]
$ stat /mnt/df0927/zzz   # as maxx
[stat never returns; ssh stops responding within ~12s; guest wedged]
[serial console shows no panic -- pure kernel thread spin in
 hpfs_validateparent:96 (dep += 0)]

--- Variant C (D0<->D1 DE_DOWN cycle): HARD HANG ---
[image: df0927_cycle.img]
$ stat /mnt/df0927/zzz   # as maxx
[stat never returns; ssh stops responding within ~12s; guest wedged]
[kernel bouncing bread(D0) <-> bread(D1) forever in
 hpfs_validateparent/hpfs_genlookupbyname dive loop with no depth cap]

=== Deterministic userspace harness (transcribes hpfs_genlookupbyname) ===
sh: cannot open ./run.sh: No such file or directory
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  10936 Jul  7 10:25 harness
=== DF-0927 deterministic dirent-walk proof ===
D_BSIZE=2048  sizeof(dirblk_t)=20  DE_HDR_SIZE=0x2f  sizeof(hpfsdirent_t)=48
lookup target = 'zzz' (sorts after dirent name 'A' so cmpfname returns >0)

[A] BUG  de_reclen=0xFFFF: oob=63507B past buf, steps=1, dives=1, oob_at_step=1
        expected OOB = 0xFFFF - (D_BSIZE - 20) = 63507 B
[A] FIX  -> rc=-1 rej_reason=1 (expect -1, reason=1 corrupt dirblk)

[B] BUG  de_reclen=0: rc(oob/spin)=-3, steps=1001 (capped; kernel = infinite loop)
[B] FIX  -> rc=-1 rej_reason=1 (expect -1, reason=1 de_reclen<min)

[C] BUG  D0<->D1 cycle: rc=-4 (expect -4 cycle), steps=0, dives=6 (capped; kernel = infinite)
[C] FIX  -> rc=-1 rej_reason=3 (expect -1, reason=3 too deep)

=== SUMMARY ===
DF_0927_BUG_A_OOB_BYTES              = 63507  (0xFFFF stride OOB)
DF_0927_BUG_B_INFINITE_LOOP          = 1  (de_reclen=0 spin)
DF_0927_BUG_C_DIVE_CYCLE             = 1  (DE_DOWN A<->B)
DF_0927_BUG_CONFIRMED                = 1
DF_0927_FIX_REJECTS_ALL_VARIANTS     = 1
RUN_EXIT=0