# DF-3004 PoC evidence pack

## What
Unconditional nlinks decrement wraps a crafted nlinks=0 inode to UINT64_MAX (userspace-visible).

## Build
```
guest: newfs_hammer -f 12G image; host: python3 h1patch2.py IMG 3004 file_3004
```

## Run
```
vnconfig; mount_hammer; ./df3004b /mnt/h1t/d/file_3004; sync; umount
```

## Expected
fstat: nlink 0 before unlink -> 4294967295 after (UINT64_MAX wrap); no panic in canonical case

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).