=== DF-3142 baseline (diag kernel #2 with DF3142 probe) ===
mounted /dev/vn0 on /tmp/hpfsmp (RW)
trigger as uid 1001:
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)
open FILE ok (fnode LSN 0x48, leaf {0,2,0x3FFE})
pwrite extend = 512
done -- check console/dmesg for the DF3142 OOB PROBE line
RUN_EXIT=0
serial console:
DF3142 OOB PROBE: i=512 alloc_words=512 lsn=0x4000 su_btotal=0x4000 dbnum=1

(hpfs_write -> hpfs_extend -> hpfs_addextent append branch
 hpfs_alsubr.c:427-436 -> hpfs_bmlookup(0, alp->al_lsn + alp->al_len =
 0x3FFE+2 = 0x4000 == su_btotal, ...) -> `lsn > su_btotal` (subr.c:340)
 admits equality -> i = 0x4000>>5 = 512 -> hpm_bitmap[512] read: exactly
 one word past the kmalloc(dbnum*BMSIZE=2048). pwrite completed normally
 afterwards: markbusy rejects the out-of-volume result and addextent
 "extended existed leaf" with the out-of-volume lsn - silent.)

NOTE on earlier attempts: the first image put FILE's fnode at 0x3FFF
(LSN%8==7) and hit DF-3141's vget read-fault (Fatal trap 12, memmove+0x95)
before the extend; with su_btotal an exact band multiple the last sector
is ALWAYS LSN%8==7, so the off-by-one is only reachable from a page-safe
fnode via the al_lsn+al_len call sites (alsubr.c:435/622) - done here.

=== DF-3142 fix validation (lsn > su_btotal -> lsn >= su_btotal) ===
open FILE ok (fprobe LSN 0x48, leaf {0,2,0x3FFE})
pwrite extend = -1            <- ENOSPC ("OUT OF VOLUME"), extend cleanly refused
no DF3142 line in dmesg/serial (grep -c DF3142 boot.log == 1: the
pre-fix baseline only)