DF-2616 forensic analysis of the flushed image after the groomed variant-E run
(kernel #1, INVARIANTS OFF; f1 DATA bref data_off=0x200ff0a: radix 10 VALID,
 lbase 0x200ff00 misaligned + crossing; read + write of /mnt/h2/f1 executed)

attacker pattern 'DF2616OOBWRITE' found in flushed image at offset 0x200ff05
(= f1's crossed window tail 0x200ff00 + 5-byte LZ4 header; the kernel wrote
 the file data through chain->data = bp->b_data + 0xFF00, i.e. 0xFF00 bytes
 into the tail of the 64KB DIO window buffer and 0x300 bytes PAST ITS END)

bytes at 0x200ff00..0x200ff30: 1f000000ea4446323631364f4f4257524954450e001f0a0f00ffffffce50444632363100000000000000000000000000

w0 relocated window 0x2100000 after in-place junk write: 18000000484a554e4b0400140a0d000f0900ffffffd2504b4a554e4b00000000
-> all 32 relocated w windows flushed with compressed junk: in-place
   overwrite at the relocated (valid-geometry) data_offs confirmed.

The 0x300-byte OOB half of the f1 pattern write landed in the kernel buffer
occupying the next 64KB KVA slot (vfs_bio.c:638 fixed per-header KVA).
That slot held a clean (zero) buffer in this run, so it was never flushed;
the crossed READ in the same run returned those zeros to userspace (see
run_E_noinv.log step 2: f1 read = 0x100 in-window zeros + OOB zeros,
with no fault -- the OOB page was mapped).