DF-3078 run.patched.log — FIX-VALIDATION (kernel #1 with fix.diff)
Guest: DragonFly 6.5-DEVELOPMENT #1: Sun Sep  6 02:02:00 UTC 2026
       (sys/vfs/ufs/ffs_vfsops.c patched with findings/poc/DF-3078/fix.diff:
        geometry cross-check in ffs_reload + newfs->fs_fmod = 0)

=== fsize0 (baseline: Fatal trap 18 idivl) ============================
MOUNTED_RO
patched int32 sb+52 = 0 (0x00000000)
CRAFTED fsize0
mount: Invalid argument
RELOAD_RC=1
GUEST_STILL_UP
FS_ACCESSIBLE

=== ncg=0x20000000 (baseline: vm_fault stack-guard panic) =============
MOUNTED_RO
patched int32 sb+44 = 536870912 (0x20000000)
CRAFTED ncg
mount: Invalid argument
RELOAD_RC=1
GUEST_STILL_UP
FS_ACCESSIBLE

=== cssize=0x80000 (baseline: silent 522KB heap smash) ================
MOUNTED_RO
patched int32 sb+156 = 524288 (0x00080000)
CRAFTED cssize
mount: Invalid argument
RELOAD_RC=1
GUEST_STILL_UP
FS_ACCESSIBLE

=== sbsize_fault=65536 (baseline: trap 12 supervisor-read fault) =====
patched int32 sb+104 = 65536 (0x00010000)
CRAFTED sbsize_fault
mount: Invalid argument
RELOAD_RC=1
RW_UPGRADE_RC=0                     [RW upgrade uses the OLD in-core sb]
GUEST_STILL_UP=OK

=== sbsize_leak=8192 (baseline: 6KB heap -> media) ====================
patched int32 sb+104 = 8192 (0x00002000)
CRAFTED sbsize_leak
mount: Invalid argument
RELOAD_RC=1
RW_UPGRADE_RC=0
leak region [sb+2048..8192) = all zeros    [no OOB read performed]
GUEST_STILL_UP=OK

=== Regression: unchanged reload ======================================
MOUNTED_RO
RELOAD RETURNED
RELOAD_RC=0
GUEST_STILL_UP
FS_ACCESSIBLE

=== Regression: normal RW mount + file create =========================
RW_MOUNT_OK
-rw-r--r-- 1 root wheel 0 Sep  6 02:13 /mnt/gv/proof
hello df3078
REGRESSION_OK

fix_status: FIXED — every crafted variant cleanly rejected with EINVAL,
guest never panics; legitimate reloads and RW mounts unaffected.