--- a/sys/vfs/ext2fs/ext2_htree.c
+++ b/sys/vfs/ext2fs/ext2_htree.c
@@ -325,6 +325,15 @@
 		}
 		found = start - 1;
 
+		/*
+		 * DF-3085: a hash sorting below every real dx entry resolves
+		 * to the count/limit overlay slot (start-1 == entp); pin it
+		 * to the first real entry instead so the search lands in the
+		 * block that owns the lowest hash range.
+		 */
+		if (found <= entp)
+			found = entp + 1;
+
 		level_info = &(info->h_levels[info->h_levels_num - 1]);
 		level_info->h_bp = bp;
 		level_info->h_entries = entp;