== patched-kernel run on 6.5-DEVELOPMENT #1 (single-fix kernel) ==

[root@dfbsd] ~# cc -o /root/trigger /root/trigger.c
[root@dfbsd] ~# vnconfig -c vn1 /root/evil.img
[root@dfbsd] ~# mount_hammer /dev/vn1 /mnt/test
[root@dfbsd] ~# /root/trigger /mnt/test
[*] issuing HAMMERIOC_DEDUP on two patched DATA leaves (data_len=0x7FFFFFFF)
[*] ioctl returned -1 (errno=5 'Input/output error'); head.flags=0x0 head.error=0
[trigger exits 0; guest stays up]

== dmesg (kernel log of the same run) ==

hammer_btree_extract: bad data_len 2147483647 for leaf @ a000000022010000

== conclusion ==

The same patched image that panicked the unpatched #0 kernel now produces a
clean EIO return from the ioctl (the new explicit bounds check at
hammer_btree.c:736-741 rejects data_len > HAMMER_XBUFSIZE).  The kernel
prints the diagnostic via hdkprintf and the guest stays up.

Reproduced 3 times — identical result each run (deterministic).