MOUNT_OK
uid=65534 euid=65534, issuing HAMMER2IOC_BULKFREE_SCAN
ioctl -> r=0 errno=0 sstop=4000000
TRIGGER_RC=0
===DMESG===
hammer2: pass 0000000000000000-0000000004000000 (all media)
hammer2_bulkfree: Scanning testvol
hammer2_bulkfree_scan: illegal radix-0 data_off 0000000001800800 e000000000000003/64
hammer2_bulkfree: Scanning LOCAL
bulkfree lastdrop 1 0
hammer2_bulkfree - range 0000000001400c00-0000000004000000
bulkfree pass statistics (100.00% storage processed):
    transition->free   0
    transition->staged 0
    ERR(00)->allocated 0
    ERR(01)->allocated 0
    staged->allocated  0
    ~4MB segs cleaned  0
    linear adjusts     0
    dedup factor       0
    max saved chains   0

----
[summary] Fixed kernel (DF-2649+DF-2650 combined patch), exact same PoC:
MOUNT_OK; unprivileged (uid 65534) HAMMER2IOC_BULKFREE_SCAN:
  hammer2_bulkfree_scan: illegal radix-0 data_off 0000000001800800 e000000000000003/64
  scan completes ("Scanning LOCAL" ... "bulkfree pass statistics (100.00%)")
  ioctl -> r=0 errno=0 sstop=4000000   TRIGGER_RC=0
NO PANIC (baseline stock kernel: panic at bulkfree.c:848, guest down).