== DF-3133: dirfs_node_chsize destructive-before-validate ==

-- A) unlinked-but-open file (dn_parent NULLed by dirfs_nremove vnops.c:914-916)
    chsize returned 14 (Bad address)
    [OK] BUG A1: truncate(NULL) -> EFAULT after damage already done (subr.c:778-787)
    [OK] BUG A2: acknowledged (dirty) write DESTROYED without flush (vfs_vm.c:300-302 via nvtruncbuf)
    [OK] BUG A3: pager/VM object truncated to 0 while host file unchanged (mmap view SIGBUS)
    [OK] host data still alive via open fd (POSIX unlink semantics intact on host)
    [OK] BUG A4: guest re-read resurrects OLD data — the acknowledged write is silently REVERTED
    [OK] FIXED A: clean ENAMETOOLONG
    [OK] FIXED A: zero damage, dirty buffer intact

-- B) absolute path > MAXPATHLEN built via fd-relative openat() (the dirfs fd-cache trick)
    [OK] B-sanity: 4x240 boundary path truncates normally
    [OK] BUG precondition: >MAXPATHLEN tree IS constructible via fd-relative openat() (dirfs does the same through the passive fd cache)
    chsize returned 14 (Bad address)
    [OK] BUG B1: absolute_path NULL (count > MAXPATHLEN, subr.c:433-442) -> truncate(NULL) EFAULT
    [OK] BUG B2: dirty buffer destroyed + pager truncated before the failing truncate
    [OK] FIXED B: ENAMETOOLONG, zero damage

-- C) valid path, host refuses truncate (root-owned file) -> EPERM after damage
    chsize returned 13 (Permission denied)
    [OK] BUG C1: host refuses the truncate (non-owner)
    [OK] BUG C2: guest pager/buffers for a file we cannot modify were destroyed anyway (subr.c:779-785 BEFORE :786)
    [OK] C: host file untouched (verified byte-identical state)

== summary: 9 bug-confirmations, 0 mismatches ==
harness exit code: 2 (2 = BUG CONFIRMED + FIX VALIDATED)