/*
 * DF-2554 PoC: see gen_image.py (the trigger is a crafted on-disk image, not
 * a userspace program). This stub documents the host-side path; the actual
 * trigger is run.sh -> mount_ntfs of gen_image.py's output.
 *
 * Bug: sys/vfs/ntfs/ntfs_vfsops.c ntfs_mountfs:354
 *      ntmp->ntm_bpmftrec = (1 << (-cpr)) / ntmp->ntm_bps;   // #DE if bf_bps==0
 * bf_bps is read straight from the untrusted boot sector (:331) with the only
 * validation being the 8-byte "NTFS    " magic at :343.
 */