DF-3138 — OOB write into adjacent kernel heap chunk, observed via kernel log

Trigger: pwrite(1)@512 as uid 1001 on file F00 (P: AB_NODES busycnt=61 freecnt=1; C: full leaves).
The :599 bcopy writes an[61]={~0, 0x200} at P.b_data[508:516) -> 4 bytes past the
512-byte chunk; the neighbor chunk held the just-allocated N1 buffer's data,
whose as_magic got overwritten with 0x00000200 (=N1's lsn, chosen via bitmap).

Console (dmesg):
  hpfs_breadstruct: MAGIC DOESN'T MATCH (0x00000200 != 0x37e40aae)
  hpfs_addextentr: FAILED 22
  hpfs_addextent: FAILED 22
  hpfs_extend: FAILED TO ADD EXTENT 22
  hpfs_write: hpfs_extend FAILED 22

The split's OOB source read [512,516) fed the same 0x200 back into N2.an[30].an_lsn,
which the children-reparenting loop then dereferenced (breadalsec(0x200) -> N1 ->
corrupted magic). pwrite returns EINVAL; kernel stays up THIS run (adjacency hit a
buffer); the earlier 40-file run crashed the kernel (unclean shutdown, fsck on reboot).

Image scan: no sector in df3138_one.img starts with 0x00000200 -> the value can only
have come from the OOB write into neighboring heap memory.