=== DF-2605 BASELINE run: radix=32 (UB shift path) on UNPATCHED kernel (#0) ===
On gcc x86-64 -O2, `1U << 32` is UB; the SHL masks the count to 5 bits so
bytes wraps to 1 (instead of the intended 4GB).  This is a mis-sizing bug
(implementation-defined), not a clean panic on this compiler.

=== Phase 4: Run PoC as unprivileged user maxx (triggers INDIRECT load) ===
[*] getdents(/mnt/h2test/testdir) -> triggers INDIRECT chain load (DF-2605)
[*] getdents returned -1 (errno=33 Numerical argument out of domain)
=== Phase 5: Cleanup (if we got here, no panic happened) ===
RUN_DONE
(Guest stayed UP.  No panic, but chain->bytes is bogus = 1 -> wrong I/O sizing.)