=== DF-2605 BASELINE run: radix=17 on UNPATCHED kernel (#0, INVARIANTS ON) ===
Trigger: unprivileged readdir (maxx) on a mounted forged hammer2 image.
Guest uname: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026

run.sh Phase 1-3 (forge radix 12->17, mount) completed normally.
run.sh Phase 4 (su maxx ./poc /mnt/h2test/testdir) -> ssh DIED: kernel panicked.

=== Serial-console panic signature (preserved in panic.txt; boot.log was
    overwritten by the later patched-kernel reboot which produced no panic) ===
Illegal: 0000000001c00000 0000000001c01000+00020000 / ffffffffffff0000
panic: assertion "pbase != 0 && ((lbase + lsize - 1) & pmask) == pbase" failed in hammer2_io_alloc at /usr/src/sys/vfs/hammer2/hammer2_io.c:126
_hammer2_io_getblk() at _hammer2_io_getblk+0xc6 0xffffffff80964d46
_hammer2_io_bread() at _hammer2_io_bread+0x17 0xffffffff80965397
hammer2_chain_load_data() at hammer2_chain_load_data+0x2a5 0xffffffff8096f4a5
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>

lsize=0x20000=131072=1<<17 (forged radix) > HAMMER2_PBUFSIZE=65536 -> crosses a
64KB page boundary -> KKASSERT fires.  Guest dropped to DDB; ssh died; down.