== dirfs_findfd boundary transcription (dirfs_subr.c:450-497)
chain 4x255: accumulated count=1024 (MAXPATHLEN=1024)
  -> returns node (count <= MAXPATHLEN): path OK: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa..."
chain 5x255: accumulated count=1280 (MAXPATHLEN=1024)
  -> returns NULL cleanly (count > MAXPATHLEN): findfd itself does NOT crash -- crash is at callers

== VULNERABLE consumer transcriptions (dirfs_vnops.c)
dirfs_getattr :391/:393
  [getattr] child killed by SIGSEGV -- NULL DEREF CONFIRMED (fault at deref of findfd() result)
dirfs_readlink :1329
  [readlink] child killed by SIGSEGV -- NULL DEREF CONFIRMED (fault at deref of findfd() result)
dirfs_alloc_file :202 (via nresolve/ncreate/nmkdir/nsymlink)
  [alloc_file] child killed by SIGSEGV -- NULL DEREF CONFIRMED (fault at deref of findfd() result)

== FIXED consumer transcriptions (NULL check + error)
  FIXED getattr: handled, error=63 (ENAMETOOLONG=63)
  FIXED readlink: handled, error=5
  FIXED alloc_file: handled, return ENAMETOOLONG

RESULT: 3/3 vulnerable consumers crashed with SIGSEGV; fixed variants survived => BUG CONFIRMED, FIX VALIDATED
harness exit code: 2 (2 = BUG CONFIRMED + FIX VALIDATED)