=== Phase 1: Forge the image (inflated INDIRECT radix=17) ===
  INDIRECT bref at 0x1800200 (parent inode @0x1800000) data_off=0x1c0100c radix=12 offset=0x1c01000
patching INDIRECT bref at 0x1800200: radix 12 -> 17 (data_off 0x1c0100c -> 0x1c01011, bytes 4096 -> 131072)
... (full CRC chain fix succeeds, image forged)
forge: done, new_radix=17

=== Phase 2: Mount the forged image read-write ===
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn0@DATA"
mount succeeded

=== Phase 3: chmod the directory for unprivileged access ===

=== Phase 4: Run PoC as unprivileged user maxx (triggers INDIRECT load via readdir) ===
su -m maxx -c "/tmp/poc /mnt/h2test/testdir"
[*] getdents(/mnt/h2test/testdir) -> triggers INDIRECT chain load
[*] getdents returned -1 (errno=33 Numerical argument out of domain)
=== poc_done rc=0 ===

=== Phase 5: Cleanup (no panic) ===
=== umount ===
umount_rc=0

--- Kernel dmesg (PATCHED #1) ---
hammer2_chain_load_data: 0000000001c01011: forged radix (bytes=131072 > HAMMER2_PBUFSIZE=65536); rejecting chain
hammer2_chain_load_data: 0000000001c01011: forged radix (bytes=131072 > HAMMER2_PBUFSIZE=65536); rejecting chain
(followed by rate-limit; subsequent rejections are silent)

Guest stays up, no panic, no OOB, mount/umount succeeds.