# DF-3067 fix validation (kernel #1, Sat Sep  5 22:10:54 UTC 2026, fix.diff applied)
$ cp base.img hang.img && ./padflood backscan hang.img | tail -3
PAD-flooded 262144 bytes at phys 0000000001088000
undo AFTER : phys=ffffffffffffffff first=3000000000001000 next=3000000000001000 alloc=3000000000040000
vol_version=6 mode=backscan crafted OK
$ sysctl -n vfs.hammer.debug_general=0x80; vnconfig -c vn0 hang.img; timeout 75 mount_hammer /dev/vn0 /mnt
  -> walk traced exactly ONE lap (ends back at rev scan_offset 3000000000001008), then:
Sep  5 22:31:02 dfbsd kernel: HAMMER(uabase) recovery failure during seqno backscan
Sep  5 22:31:02 dfbsd kernel: Failed to recover HAMMER filesystem on mount
  -> mount_hammer process EXITED (zombie => reaped), no CPU burn, guest stayed up.
# Baseline on stock kernel #0: same image = infinite walk (47,039+ iterations,
# 2+ full ring laps observed, unkillable mount, see run.log/bootlog_walk_trace.log).