vn0: MBR magic not found; assume a COMPATIBILITY_SLICE (s0)
HAMMER(df3186) recovery undo  3000000000000000-3000000000000300 (768 bytes)(RW)
HAMMER: FIFO record bad head signature 0000 at 3000000000000300
HAMMER(df3186) Illegal UNDO TAIL signature at 30000000000002f8
HAMMER(df3186) recovery complete
Failed to recover HAMMER filesystem on mount

=== DF-3186 verification narrative (host-captured) ===
image: newfs_hammer (v7 default), first mount clean, then vol_version=3 +
UNDO alloc_offset = next + 512 + 256 (non-512-congruent) via patch_undo.c.
mount_hammer RW result:
  HAMMER(df3186) recovery undo 3000000000000000-3000000000000300 (768 bytes)(RW)
  HAMMER: FIFO record bad head signature 0000 at 3000000000000300
  HAMMER(df3186) Illegal UNDO TAIL signature at 30000000000002f8
  HAMMER(df3186) recovery complete
  Failed to recover HAMMER filesystem on mount
  -> mount: Input/output error
hammer_ioc_set_version therefore never runs: HAMMERIOC_SET_VERSION requires
a RW-mounted fs (hammer_ioctl.c:627 EROFS gate), and hammer_recover_stage1
(hammer_recover.c:228-243) fails any RW mount whose undo stream cannot be
parsed up to alloc_offset. A non-congruent alloc_offset always leaves an
unparseable tail (records are 512-byte aligned), so the precondition for
the non-terminating while-loop in hammer_upgrade_undo_4 (hammer_undo.c:381)
cannot be established from a crafted image; on live filesystems every undo
writer and the flusher advance next/alloc by 512-congruent amounts.
Verdict: loop arithmetic real, trigger unreachable -> not_reproduced.