+ uname -a
+ head -1
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #3: Sun Aug 30 08:36:01 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
+ timeout 10 umount -f /mnt/h2
+ dmsetup remove_all
stat failed
stat failed
+ vnconfig -u vn0
+ mkdir -p /mnt/h2
+ echo '=== B1: sysctl=1 + forged 320MB volume -> expect mount REJECTED'
=== B1: sysctl=1 + forged 320MB volume -> expect mount REJECTED
+ sysctl 'vfs.hammer2.df2663_fail_diocgpart=1'
vfs.hammer2.df2663_fail_diocgpart: 0 -> 1
+ /root/poc/forge2663 /root/poc/base.img /root/poc/leak320B.img 0xC000010 0x00 0x14000000
DATA bref @0x1800200 -> data_off=000000000c000010 methods=00
check@0x1800a40 (block 0x1800000) = b655f10c6498c9d7
check@0x1800e40 (block 0x1800800) = 057db007bcba4063
check@0x240 (block 0x1800c00) = 24e8dfb085d30be0
volu_size/total_size -> 0000000014000000
verify 0x1800000: b655f10c6498c9d7 (stored b655f10c6498c9d7)
wrote /root/poc/leak320B.img
+ vnconfig -c vn0 /root/poc/leak320B.img
+ truncate -s 201326592 /root/poc/leak320B.img
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
mount: Invalid argument
+ echo 'B1_MOUNT_RC=1   (expect 1)'
B1_MOUNT_RC=1   (expect 1)
+ dmesg
+ tail -2
hammer2_ondisk: "/dev/vn0" zone=0 id=0 offset=0x0000000000000000 size=0x0000000014000000
hammer2_ondisk: /dev/vn0's media size could not be determined, refusing to mount
+ ls /mnt/h2
+ sysctl 'vfs.hammer2.df2663_fail_diocgpart=0'
vfs.hammer2.df2663_fail_diocgpart: 1 -> 0
+ vnconfig -u vn0
+ echo '=== B2: honest volu_size + truncated backing -> expect EIO on read'
=== B2: honest volu_size + truncated backing -> expect EIO on read
+ /root/poc/forge2663 /root/poc/base.img /root/poc/leakB2.img 0xC000010 0x00 0
DATA bref @0x1800200 -> data_off=000000000c000010 methods=00
check@0x1800a40 (block 0x1800000) = b655f10c6498c9d7
check@0x1800e40 (block 0x1800800) = 057db007bcba4063
check@0x240 (block 0x1800c00) = 24e8dfb085d30be0
verify 0x1800000: b655f10c6498c9d7 (stored b655f10c6498c9d7)
wrote /root/poc/leakB2.img
+ vnconfig -c vn0 /root/poc/leakB2.img
+ truncate -s 201326592 /root/poc/leakB2.img
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
+ echo 'B2_MOUNT_RC=0   (expect 0)'
B2_MOUNT_RC=0   (expect 0)
+ cat /mnt/h2/leakfile
+ echo 'B2_READ_RC=1   (expect 1)'
B2_READ_RC=1   (expect 1)
+ cat /root/poc/leakB2.err
cat: /mnt/h2/leakfile: Input/output error
+ ls -l /root/poc/leakB2.bin
-rw-r--r--  1 root  wheel  0 Aug 30 08:44 /root/poc/leakB2.bin
+ umount /mnt/h2
+ vnconfig -u vn0
+ echo '=== B3: regression - intact image mounts and reads correctly'
=== B3: regression - intact image mounts and reads correctly
+ vnconfig -c vn0 /root/poc/base.img
+ mount -t hammer2 -o ro /dev/vn0@leakfs /mnt/h2
+ echo 'B3_MOUNT_RC=0   (expect 0)'
B3_MOUNT_RC=0   (expect 0)
+ md5 /mnt/h2/leakfile /root/poc/rand64
MD5 (/mnt/h2/leakfile) = c19119d814a3c5158a5b92f7aa7ce872
MD5 (/root/poc/rand64) = c19119d814a3c5158a5b92f7aa7ce872
+ umount /mnt/h2
+ vnconfig -u vn0
+ echo KERNEL_B_VALIDATION_DONE
KERNEL_B_VALIDATION_DONE