# DF-3123 — latent memory-safety landmines in the `#if 0`-disabled htree write path

Info-severity analysis-only pack. **No Phase V run**: the code is dead in the
stock kernel (`ext2_lookup.c:920-941` `#if 0` gates every caller).

Contents:
- `VERDICT.md`   — the three latent defects (heap memcpy overflow in the
  index-node split gated by DF-0850's missing validation; double-brelse of
  bwrite-consumed buffers on all I/O-error paths; u16 reclen truncation at
  64 KiB blocks) with path:line citations.
- `fix.diff`     — illustrative patch for the double-brelse family (the
  highest-risk one if the path is ever re-enabled).

Relevance: FreeBSD's ext2 keeps this path compiled in; a DragonFly re-enable
without these fixes walks into a kernel heap write overflow from a crafted
image. See DF-3122 (the live-code sibling in this file) for the verified bug.