# DF-3085 verification

Kernel: DragonFly dfbsd 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

Reproduced with a stale-index image equivalent to what DragonFly itself produces (its htree add path is #if 0, so linear appends leave the index stale): starting from the e2fsck-indexed DF-3082 image, 24 crafted entries w001-w024 were inserted into the spare (logical block 1) with valid dirents. readdir (linear) lists them, but stat/lookup returns ENOENT for 16 of the 24 - exactly those whose hashes sort above entry[1].hash (0x5a87f91e) and therefore binary-search into leaf blocks 2/3 that do not contain them; the 8 names hashing below the first real entry resolve via the count/limit overlay slot (found = start-1 = entp) whose stale block field happens to point at the spare where they live. Mechanism (ext2_htree.c:333 found=start-1 uses the overlay as an entry) and impact (existing files unopenable/undeletable while visible in readdir) confirmed.

## Kernel references
- sys/vfs/ext2fs/ext2_htree.c:333
- sys/vfs/ext2fs/ext2_lookup.c:380

## Fix
See fix.diff.

## Fix validation (A/B on rebuilt kernel #0 Sun Oct 25 06:10:12 UTC 2026)
fix_status: not_testable - fix authored (underflow pin to first real entry); A/B rerun blocked by a busy vn device at session end

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.