== FIXED non-INVARIANTS kernel (DF2647_NOINV + fix.diff, uname ... DF2647_NOINV built 23:1x) ==
$ sh run_catastrophic.sh            # 0xFFFF image, previously: fatal stop in memmove
pfsget_scan: fd=3 iters=1
  [0] key=ac80c0f093968001 next=da2386b05c938000 name="zz_pwn"
  [0] key=da2386b05c938000 next=de25e1c43fe18000 name="testvol"
  [0] key=de25e1c43fe18000 next=ffffffffffffffff name="LOCAL"
pfsget_scan: done
scan returned unexpectedly (rc=0)
=== guest alive? ===
11:20PM  up 58 secs, 0 users, load averages: 0.17, 0.06, 0.02

$ dmesg | grep -m3 "corrupt name_len"
hammer2: pfs_get: corrupt name_len 65535, clamped

$ sh run_catastrophic.sh /root/poc/h2_2647_0300.img   # 0x300 image
SURVIVED_0300 / uptime OK

$ vnconfig -c vn0 h2_2647_ffff.img && mount ... && ./pfsget_scan /mnt/h2 100 50
  [99] key=de25e1c43fe18000 next=ffffffffffffffff name="LOCAL"
pfsget_scan: done
11:20PM  up 1 min, 0 users, load averages: 0.16, 0.05, 0.02
umount OK, vnconfig -u OK
FIX_VALIDATED

BASELINE for comparison (same guest, unpatched non-INVARIANTS kernel):
  0xFFFF single scan : Stopped at memmove+0x10a: repe movsq (%rsi),%es:(%rdi)   [panic_ffff_noinv.txt]
  0x300  x~65 scans  : Fatal trap 9 GPF, Stopped at _kmalloc+0x4b4              [panic_noinv.txt]
  stock INVARIANTS   : panic: assertion "ripdata->meta.name_len < sizeof(pfs->name)" failed
                        in hammer2_ioctl_pfs_get at .../hammer2_ioctl.c:494     [panic_inv.txt]