DF-2628 success-path regression on the FIXED kernel B
"DragonFly 6.5-DEVELOPMENT #0: Fri Aug 28 22:42:25 UTC 2026
 root@dfbsd:/usr/obj/usr/src/sys/X86_64_NOINV"
(fix.diff applied: nlinks bump moved inside `if (error == 0)`;
 kernel also carries the DF-2629 setattr gate)

$ mkdir -p /home/maxx/df2628succ && cd /home/maxx/df2628succ && printf base > base
$ ./u2628_poc trigger /home/maxx/df2628succ/base /home/maxx/df2628succ/lk 3
BASE /home/maxx/df2628succ/base nlink_before=1
TRIGGER: 3 link() attempts, 0 failed (errno=0/Undefined error: 0)
BASE /home/maxx/df2628succ/base nlink_after=4  delta=3
TARGET names created: 3 of 3
RESULT: all link() succeeded normally (no failure engaged - scenario not set up)
$ ./u2628_poc probe /home/maxx/df2628succ/base
/home/maxx/df2628succ/base nlink=4
$ unlink lk.000; unlink lk.001; unlink lk.002
$ ./u2628_poc probe /home/maxx/df2628succ/base
/home/maxx/df2628succ/base nlink=1
$ ./u2628_poc ctrl /home/maxx/df2628succ/base /home/maxx/df2628succ/ctrlname
CTRL link(...base, ...ctrlname) = 0 errno=0  nlink 1 -> 2
$ unlink ctrlname; ./u2628_poc probe .../base
/home/maxx/df2628succ/base nlink=1

=> exact nlink arithmetic on the success path; the fix does not disturb
normal link/unlink semantics.  (Failure-path A/B not exercisable on this
guest - see VERDICT.md 3.)