=== B: zlib-patched image (ZLIB-invalid payload @ lbase 0, ALL checks valid),
     stock kernel -- THE DF-2655 SUBSTITUTION PROOF
(unit vn8)
=== b: /root/df2655/h2z.img mounted (uname: DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC )
--- read zfile (dd full 128KB):
1+1 records in
1+1 records out
114688 bytes transferred in 0.000647 secs (177211804 bytes/sec)
dd exit: 0
--- md5 read-back vs original:
MD5 (/root/df2655/zfile.B.readout) = b1e63222a373994ee242ce1a7e3da0fc
MD5 (/root/df2655/zfile.orig)      = 876569bdd45df2756a69a3fe85660f2a
--- first 32 bytes read back:
           00  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00
*
--- first differing byte (orig vs readback):
/root/df2655/zfile.orig /root/df2655/zfile.B.readout differ: char 1, line 1
--- nonzero bytes in first 64K block:
       0          <-- the entire first 64KB block is FABRICATED ZEROS
--- dmesg tail:
vn8: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
hammer2_mount: devstr="/dev/vn8@LOCAL"
hammer2_mount: device="/dev/vn8" label="LOCAL" rdonly=1
hammer2_ondisk: "/dev/vn8" zone=0 id=0 offset=0x0000000000000000 size=0x0000000080000000
hammer2_mount: hmp=0xfffff801252c0000 pmp=0xfffff801245e4000
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
HAMMER2: CONN WAS TERMINATED
(the "HAMMER2 ZLIB: Fatal error during decompression." kprintf fired during
 the dd; visible in the b2/b3 runs below where it lands inside the tail
 window, and in the serial console log for all three runs)

RESULT: read(2) returned 114688 bytes with exit 0 (SUCCESS) while the first
64KB block was substituted by kernel-fabricated zeros.  Block 2 (lbase
0x10000, untouched) read back intact -- md5 b1e63222... differs from the
original 876569bd... ONLY in the first 64KB.

determinism: identical fabricated md5 b1e63222a373994ee242ce1a7e3da0fc on
three independent mounts (runs b, b2 on vn9, b3 on vn10 -- see summary in
VERDICT.md; b2/b3 dmesg tails show the kprintf explicitly).