DF-3146 + DF-3147 fix validation — patched kernel
DragonFly dfbsd 6.5-DEVELOPMENT #1: Mon Sep 7 04:20:56 UTC 2026
(built in-guest: make -j8 nativekernel && make installkernel, with
findings/poc/DF-3146/fix.diff applied to /usr/src — cd9660_rrip.c NM length
guard + cd9660_vnops.c uio_off init; full build log: fix_build.log).
Triggers as nobody, mounts by root (setup), 2026-09-07.

=== baseline (stock #0) -> patched (#1) ===

warm image (was: Fatal trap 12, Stopped at memmove+0x24f repe movsq):
ino=65726 namlen=16 type=0 : namelen=16 name hex: 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50
getdents rc=0 errno=0      <- no panic; NM len=4 ignored, payload parses as name

cold1 image (was: namlen=16 with STALE HEAP name 2e 2e 00... + 16-byte
             controlled write at idp-65536):
ino=65726 namlen=16 type=0 : namelen=16 name hex: 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50
getdents rc=0 errno=0      <- no rewind: payload written into d_name where it belongs

cold20 image (was: same silent write at idp-1310720):
ino=65726 namlen=16 type=0 : namelen=16 name hex: 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50
getdents rc=0 errno=0      <- no write below the allocation

ce64 image, N=16140 (was: panic: assertion "obj != NULL" failed in
vm_object_hold_shared; isofntrans in trace):
ino=65726 namlen=1 type=0 : namelen=1 name hex: 43
getdents rc=0 errno=0      <- no panic; NM4 pairs ignored; CE chain walked and
                              terminates in the defname fallback ("C")

DF-3147 tinyseek (was: lseek(SEEK_CUR) = 0x686 (1670) — stale uio_off of an
unrelated isoreaddir leaked after a failed 8-byte getdents):
getdents(8) rc=0 ; lseek(SEEK_CUR) = 0x0 (0) errno=0
                           <- offset now tracks the uio offset (0) — no
                              uninitialized kernel heap disclosed

Guest stayed up through all five runs (vm.sh status: up).