# DF-2652 — freemap recovery marks the wrong 16K chunk (bit 18 dropped)

`hammer2_freemap_adjust()` (DORECOVER — mount-time crash recovery and the
default-enabled dedup re-registration path) computes the bit-pair index of
a 16KB chunk inside its 512KB bitmapq[] element with a 4-bit mask
(`& 15`, freemap.c:1073) although elements hold 32 chunks.  For every
chunk in the upper 256KB of a 512KB element the fixup marks the chunk
256KB lower and leaves the real chunk marked FREE — the allocator then
hands the still-live block to the next writer, producing overlapping
allocations and silent cross-file data corruption.

## Reproduce

Host:
```
python3 forge_2652.py base2651.img forge2652.img          # pair-clear + mtid bumps
python3 - <<'EOF'                                          # bleed variant (optional)
# set methods=0x00 (CHECK_NONE) on fileA's 24 DATA brefs in the indirect
# block at 0x2000000, recompute volhdr CRCs  (see build.sh for the exact code)
EOF
```
Guest (root):
```
vnconfig -c vn0 /tmp/forge2652.img
mount -t hammer2 /dev/vn0@testvol /mnt/h2t     # mounts fine (silent bug)
cp /tmp/fileB.bin /mnt/h2t/fileB; sync; umount /mnt/h2t; vnconfig -u vn0
vnconfig -c vn0 /tmp/forge2652.img             # remount
md5 /mnt/h2t/fileA                             # -> I/O error (default iscsi32 brefs)
dd if=/mnt/h2t/fileA bs=16k skip=16 count=4 | grep -ao "FILE[AB]-CHUNK-[0-9]*"
                                               # bleed variant: FILEB-CHUNK-000000..
```
Expected on stock kernel: fileA's 64K at 0x1c40000 overwritten by fileB
(host-side: `FILEB-CHUNK-000000` at disk offset 0x1c40000, fileA chunk
16-19 headers gone), fileA read → EIO (or FILEB content on the no-check
variant).  On the fixed kernel: fileA md5 matches the pristine
fileA.bin, chunks 16..19 read FILEA-CHUNK-000016..19.