mount root (dm_path) = /tmp/df3056RrCF2t
nrename: rename("/tmp/df3056RrCF2t/dirA/f", "/tmp/df3056RrCF2t/dirB/f")
post-rename node: name="f" parent="dirA" (parent NOT updated -- dirfs_vnops.c:987 has no dn_parent update)

victim file created at OLD path /tmp/df3056RrCF2t/dirA/f (mode 0600)

VULN: user calls chmod 0777 on their moved file (vnode == dirB/f)
      generic layer checks pass (user owns the vnode); dirfs_node_chmod builds:
      lchmod("/tmp/df3056RrCF2t/dirA/f", 0777)   <-- STALE PATH
      lchmod returned error=0
      stat(/tmp/df3056RrCF2t/dirA/f) [the VICTIM]:  mode=0777  *** VICTIM MODIFIED (wrong-file op) ***
      stat(/tmp/df3056RrCF2t/dirB/f) [the TARGET]:  mode=0644  (untouched — split-brain confirmed)
      getattr via stale node returns mode=0777 (error=0) -> ls -l shows the VICTIM's attributes for dirB/f

FIXED: dn_parent updated to tdnp on rename
      lchmod("/tmp/df3056RrCF2t/dirB/f", 0644)
      stat(/tmp/df3056RrCF2t/dirB/f): mode=0644 -> correct file modified
      stat(/tmp/df3056RrCF2t/dirA/f): mode=0777 -> victim left alone

RESULT: VULN path operated on the wrong file at the old path (victim mode 0600->0777); FIXED variant operates on the moved file => BUG CONFIRMED, FIX VALIDATED
harness exit code: 2 (2 = BUG CONFIRMED + FIX VALIDATED)