(in-guest build; /tmp is tmpfs so raw make logs did not survive the reboots --
 this is the decisive, session-captured record)

# baseline PoC build
root@dfbsd# cc -O -o /tmp/op2999 /tmp/op2999.c -Wall
(no errors, no warnings)

# fix+probe kernel build (fix.diff applied to /usr/src/sys/vfs/hammer/hammer_vnops.c)
root@dfbsd# md5 /usr/src/sys/vfs/hammer/hammer_vnops.c
MD5 (/usr/src/sys/vfs/hammer/hammer_vnops.c) = 331657474c737c977d7d2b82553da658
root@dfbsd# grep -c OFF_MAX /usr/src/sys/vfs/hammer/hammer_vnops.c
2
root@dfbsd# cd /usr/src && make -j4 nativekernel KERNCONF=X86_64_GENERIC
...
>>> Kernel build for X86_64_GENERIC completed on Sat Sep  5 01:28:38 UTC 2026   (stock rebuild)
   (incremental rebuild with fix: kernel.stripped dated Sep  5 01:44, 15706056 bytes)
root@dfbsd# make installkernel KERNCONF=X86_64_GENERIC
/boot/kernel/kernel  mtime Sep  5 01:50:28 2026
root@dfbsd# uname -v
DragonFly 6.5-DEVELOPMENT #2: Sat Sep  5 01:44:36 UTC 2026
    root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC

# fix validation run (kernel #2, as unprivileged user maxx, HAMMER1 at /mnt/h1)
$ time /tmp/op2999 /mnt/h1/maxx2999.bin
extend-> File too large
        0.00 real         0.00 user  0.00 sys
EXIT=1
=> the first ftruncate(0x7ffffffffffff000) is now rejected immediately
   (EFBIG) by the va_size clamp; the wrap-prone truncate is never reached;
   no wedge, no R4 thread, killable, clean guest.

# smoke test (fix does not break normal operation)
$ echo smoke > /mnt/h1/s.txt; dd if=/dev/zero of=/mnt/h1/smoke.bin bs=64k count=20
$ truncate -s 1000000 /mnt/h1/smoke.bin; truncate -s 100 /mnt/h1/smoke.bin
$ cat /mnt/h1/s.txt -> smoke ; md5 smoke.bin ok ; rm ok
SMOKE_OK