# DF-3002 PoC evidence pack

## What
Crafted leaf data_offset==0: hammer_btree_extract success + NULL data -> NULL-deref panics in readdir/nresolve.

## Build
```
guest: newfs_hammer -f on 12G sparse vn image; host: python3 h1patch2.py IMG 3002 file_2902
```

## Run
```
vnconfig -c vn0 IMG; mount_hammer /dev/vn0 /mnt/h1t; ls /mnt/h1t; ls -la /mnt/h1t/d  -> panic
```

## Expected
Fatal trap 12, fault VA 0x0, hammer_vop_readdir+0x1e8 on ls of the crafted dir

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).