=== DF-2998 fixed-kernel runs (fix.diff applied, single-fix nativekernel, uname '#1: Mon Oct 12 12:33:28 UTC 2026') ===
=== part 1: TEST 1 + TEST 1b — retypes must be REFUSED ===
-rwxr-xr-x  1 root  wheel  13880 Oct 12 12:47 trigger2998
MOUNT_OK rc=0
using rdev of /dev/vn0: 8 504430599

=== TEST 1: live VREG->VDIR retype + VCHR injection (as root) ===
BEFORE: type=REGULAR mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
[*] telling server: LIE file DIR ...
AFTER-DIR-LIE: fstat FAILED: RPC struct is bad
(no retype observed)
getdents(open 'file' fd, now VDIR) = -1 (Invalid argument)
[*] telling server: LIE file CHR 8 504430599 ...
AFTER-CHR-LIE: fstat FAILED: RPC struct is bad
open(/mnt/f) after CHR lie = -1 (RPC struct is bad)
[*] telling server: LIE file DIR again (3rd retype) ...
AFTER-DIR-RELIE: fstat FAILED: RPC struct is bad
TRIGGER_RC=0

=== reset lies, fresh mount ===
sent: RESET
UMOUNT_RC=0 (expect clean)
REMOUNT_OK rc=0

=== TEST 1b: same retype as an UNPRIVILEGED user ===
BEFORE: type=REGULAR mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
[*] telling server: LIE file DIR ...
AFTER-DIR-LIE: fstat FAILED: RPC struct is bad
(no retype observed)
getdents(open 'file' fd, now VDIR) = -1 (Invalid argument)
[*] telling server: LIE file CHR 8 504430599 ...
AFTER-CHR-LIE: fstat FAILED: RPC struct is bad
open(/mnt/f) after CHR lie = -1 (RPC struct is bad)
[*] telling server: LIE file DIR again (3rd retype) ...
AFTER-DIR-RELIE: fstat FAILED: RPC struct is bad
UNPRIV_RC=0

=== reset lies, fresh mount ===
sent: RESET
UMOUNT_RC=0 (expect clean)
REMOUNT_OK rc=0

=== TEST 2: cookie-cached VDIR->VREG retype, then umount ===
(SKIP_TEST2=1: stopping before the umount crash test)
=== DONE ===

=== part 2: TEST 2 — VDIR->VREG must be refused, umount must be clean ===
big: drained 12000 bytes of dirents (>4096: cookies cached)
BEFORE: type=DIRECTORY mode=000777 uid=0 gid=0 size=524288 rdev=255,-65281
[*] telling server: LIE big REG ...
AFTER-REG-LIE: stat FAILED: RPC struct is bad
(no retype observed)
TRIGGER_RC=1
[*] umounting NOW
UMOUNT_RC=0 (reached = no panic)