=== DF-2605 FIX-VALIDATION: same PoC on PATCHED kernel (#1, single-fix) ===
Patched kernel: DragonFly 6.5-DEVELOPMENT #1: Sat Aug  8 17:19:42 UTC 2026
sha256(/boot/kernel/kernel) = b55c935365f725118c0266353e59370b32d3ea589f9f87d364467e97b5a915ca

--- radix=17 (was PANIC on baseline #0) ---
[*] getdents(/mnt/h2test/testdir) -> triggers INDIRECT chain load (DF-2605)
[*] getdents returned -1 (errno=33 Numerical argument out of domain)
=== Phase 5: Cleanup (if we got here, no panic happened) ===
RUN_DONE
(guest UP, no panic, no KKASSERT. chain rejected cleanly.)

dmesg (warnonce from the new alloc-site guard):
hammer2_chain_alloc: 0000000001c01011: forged radix=17 (max=16); capping and marking chain errored
hammer2_chain_alloc: 0000000001c01011: forged radix=17 (max=16); capping and marking chain errored

--- radix=32 (UB shift path; bogus bytes=1 on baseline) ---
[*] getdents(/mnt/h2test/testdir) -> triggers INDIRECT chain load (DF-2605)
[*] getdents returned -1 (errno=33 Numerical argument out of domain)
=== Phase 5: Cleanup ===
RUN_DONE
(guest UP. The UB `1U<<32` is no longer executed; alloc caps via 1U<<HAMMER2_RADIX_MAX
 and marks errored; load_data returns before any I/O.)

--- radix=17 run #2 (determinism) ---
[*] getdents returned -1 (errno=33 Numerical argument out of domain)
RUN_DONE
(guest UP.)

--- regression check: CLEAN (unforged) image still works ---
ls /mnt/h2test/testdir/ -> 13 files listed (file1.txt..file12.txt + long-name)
mount+readdir unaffected by the fix -> NO regression.