# DF-2635 — iroot meta.inum desync walks off the inum hash in hammer2_inode_drop

## What
`hammer2_inode_get(pmp, NULL, 1, -1)` hashes the freshly-created PFS root
inode under `inumhash(pmp, 1)` (hammer2_inode.c:933, 954-977). Afterwards,
two mount paths overwrite the inode's meta *wholesale* from media:

* `hammer2_pfsalloc`: `iroot->meta = ripdata->meta;`  (hammer2_vfsops.c:456)
* `hammer2_vfs_root`: `pmp->iroot->meta = *meta;`     (hammer2_vfsops.c:1975)

If the on-media PFS-root `meta.inum` is not 1 (crafted or corrupted image),
the in-memory inode now sits on the wrong inum-hash bucket. At unmount,
`hammer2_inode_drop()` computes the bucket from the *current*
`ip->meta.inum` (hammer2_inode.c:617) and walks the wrong list:

```c
xipp = &hash->base;
while (*xipp != ip)            /* hammer2_inode.c:624 */
        xipp = &(*xipp)->next;
```

`next` is the first field of `struct hammer2_inode`, so once the walk falls
off the end, `xipp` degenerates to NULL and `*xipp` reads address 0 —
NULL-deref panic during `umount` (the drop is reached from
hammer2_vfsops.c:707-711 where unmount drops the last iroot ref).

Secondary effect: `hammer2_inode_lookup(pmp, 1)` can no longer find iroot
(its meta.inum no longer matches what lookups compare) while lookups of the
*media* inum find nothing either (iroot is on bucket 1) — in-memory inode
aliasing / inconsistent namespace semantics until the wedge.

## Reproduce (guest, root)
```
python3 forge_2635.py h2base.img craft2635.img   # host: inum 1 -> 0x42
scp craft2635.img dfbsd:/root/poc/df2635/
sh run.sh
```
run.sh: vnconfig + `mount_hammer2 /dev/vn1@testvol /mnt/h2635` (RW),
`ls`, write+cat a file, `sync`, then `umount`.

## Expected
Mount/ls/write/sync all succeed; `umount` panics:

```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0x0
Stopped at hammer2_inode_drop+0x1e3: movq (%rax),%rdx     (from umount)
```

Observed verbatim on the stock kernel — see panic.txt / run.log.

## Fix
Keep the hashed inum stable across the meta overwrites and harden the
drop-side walk — see fix.diff.