DF-2619 console evidence (verbatim from the QEMU serial console, captured 2026-08-28/29)

=== [A] STOCK INVARIANTS kernel #0 -- first battery, getdents on the forged
    image: the OOB read past the 64KB DIO buffer hit an UNMAPPED page
    (kernel panics; guest sat in DDB) ===

Fatal trap 12: page fault while in kernel mode
cpuid = 2; lapic id = 2
fault virtual address	= 0xfffff8005f926000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff80bcaba9
stack pointer	        = 0x10:0xfffff801192b3670
frame pointer	        = 0x10:0xfffff801192b36c8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1013
current thread          = pri 10 
kernel: type 12 trap, code=0

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      memcpy+0x19:    movq    (%rsi),%rdx
db> 

# RIP 0xffffffff80bcaba9 = memcpy+0x19 (nm -n /boot/kernel/kernel:
# ffffffff80bcab90 T memcpy).  Fault VA 0xfffff8005f926000 is page-granular
# -- the page immediately after the 64KB DIO buffer holding the forged
# dirent block (window 0x2100000, block at DIO+0xFF80).

=== [B] STOCK kernel #0 -- same forged image, later run with a mapped
    adjacent page: NO panic, the OOB bytes are copied to userspace.
    See run_stock.log for the full getdents dump; the dirent name ends
    with 127 bytes of adjacent kernel memory, e.g.:
      ...AAAA(128 x 'A')\x01\x00...\x00
      6f54f378235a0600 6f54f378235a0600 ... c0010000 02000000 ...
    (0x00065a2378f3546f LE pointer-like values, 0x1c0/2 counter-like
    fields -- kernel buffer-adjacent data.)

=== [C] INSTRUMENTED kernel #1 -- stat() path: the fault is INSIDE the
    name compare of hammer2_chain_dirent_test (instrumented byte loop,
    semantically identical to the stock bcmp at chain.c:5784) ===

Stopped at      hammer2_chain_dirent_test+0x89: cmpb    %sil,(%rcx,%r8,1)

# The compare index reached the page after the DIO buffer while walking
# the 255-byte name against the 128-byte block; no mismatch occurred
# earlier because bytes 0..127 were forged to match the name.

=== [D] INSTRUMENTED kernel #1 -- getdents path, full backtrace
    (debug.debugger_on_panic=0, dump saved) ===

Fatal trap 12: page fault while in kernel mode
cpuid = 3; lapic id = 3
fault virtual address	= 0xfffff80055af6000
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809d79e4
...
panic: page fault
...
trap_fatal() at trap_fatal+0x301
trap_pfault() at trap_pfault+0x475
trap() at trap+0x17c
calltrap() at calltrap+0x9
--- trap 000000000000000c, rip = ffffffff80bcae39, rsp = ..., rbp = ... ---
memcpy() at memcpy+0x19
hammer2_vop_readdir() at hammer2_vop_readdir+0x5c8

# hammer2_vop_readdir+0x5c8 = the vop_write_dirent(...) call at
# vnops.c:729 copying namlen(=255) bytes from chain->data->buf
# (vnops.c:727) into the getdents buffer.