=== DF-3143 run (stock kernel, guest uname below) ===
trigger: stat /tmp/hpfsmp as uid 1001 after RW-mount of df3143.img

mounted /dev/vn0 on /tmp/hpfsmp (RW)
MOUNT_RC=0
--- stat mountpoint as uid 1001 (expect HANG) ---
uid=1001(maxx) gid=1001(maxx) groups=1001(maxx)

=== post-hang probes (each via ssh, hard timeouts) ===
$ ssh dfbsd 'sh /tmp/df3143_check.sh'  -> printed ps header, then HUNG (rc=124 at 60s)
$ ssh dfbsd 'ps ax | grep stat ...'   -> NO OUTPUT (rc=0? channel died)
$ ssh dfbsd 'ps ax | grep -E "stat|hpfs"' -> rc=124 (hung)
$ ssh dfbsd 'mount | grep hpfs'      -> rc=124 (hung: getfsstat wedges on the hpfs mount)
$ ssh dfbsd 'dmesg | tail -3'         -> 'Connection timed out during banner exchange' (sshd starved)
$ ssh dfbsd 'echo simple_ok'          -> simple_ok (guest network still alive)
$ ssh dfbsd-maxx 'echo maxx_ok; id'   -> works (uid=1001)