# DF-2636 — panic on unhandled on-media objtype in hammer2_igetv

## What
`hammer2_igetv()` (sys/vfs/hammer2/hammer2_inode.c:744-795) switches on
`ip->meta.type` to initialize the vnode. `meta.type` is copied verbatim from
the on-media inode (`hammer2_pfsalloc`: `iroot->meta = ripdata->meta`,
hammer2_vfsops.c:456). Any on-media value outside
{DIRECTORY,REGFILE,SOFTLINK,CDEV,BDEV,FIFO,SOCKET} — e.g. 0 (UNKNOWN), 3,
8, 10 (WHITEOUT), 11..255 — hits:

```c
default:
        panic("hammer2: unhandled objtype %d", ip->meta.type);
```

An attacker who can craft (or bit-flip, given a checksum-forged image) a
hammer2 filesystem image gets an unconditional kernel panic at mount or at
the first VFS_ROOT (ls/stat) on the mount. Mounting requires root (or
vfs.usermount policies), same trust boundary as the rest of the
crafted-image family (DF-0763/DF-0804/DF-0875/DF-2616...).

## Reproduce (on the DragonFly QEMU guest, as root)
```
# forge: flip meta.type (inode block +0x50) of the 'testvol' PFS root
# inode to 0x42, set CHECK_NONE on ancestors, recompute volhdr CRC32Cs
python3 forge_2636.py h2base.img craft2636.img     # host side
scp craft2636.img dfbsd:/root/poc/df2636/          # guest side
sh run.sh
```
run.sh does: vnconfig + `mount_hammer2 -o ro /dev/vn1@testvol /mnt/h2636`
+ `ls -la /mnt/h2636`.

## Expected
Mount succeeds; the first VFS_ROOT (the lstat inside ls) panics:

```
panic: hammer2: unhandled objtype 66
hammer2_igetv() at hammer2_igetv+0x42a
hammer2_vfs_root() at hammer2_vfs_root+0xdc
nlookup() at nlookup+0xb9c
kern_stat() ... sys_lstat()
```

Observed verbatim on the stock INVARIANTS kernel — see panic.txt / run.log.

## Fix
Return an error (and mark the vnode VBAD) instead of panicking; see fix.diff.