DF-3187 run log — full transcript of the decisive runs.

=====================================================================
[1] STOCK KERNEL (baseline) — DragonFly 6.5-DEVELOPMENT #0, Jul 2 2026
=====================================================================
image: /home/maxx/h1.img (vn0, 10G sparse, newfs_hammer -f -L test, v7),
       hammer pfs-master /mnt/p1; echo hello >/mnt/f1; hammer synctid quick;
       umount; ./patch_dlen h1.img -1
       -> found PFS leaf @off=554205184: key(pfs lo)=00010000 data_len=292 -> -1
       -> patched node @off=554205184 (crc algo iscsi/v7)

# mount -o ro -t hammer /dev/vn0 /mnt && chmod 755 /mnt
MOUNTED-RO

$ ./trigger_scan /mnt 1          (uid 1001, unprivileged)
trigger: SCAN_PSEUDOFS pfs_id=1 on /mnt uid=1001
<hang — ssh session never returns; guest wedged in ddb>

console (dfbsd-qemu/boot.log):
Fatal trap 12: page fault while in kernel mode
fault virtual address  = 0xfffff800555da004
fault code              = supervisor read data, page not present
instruction pointer     = 0x8:0xffffffff809d4ea0
current process         = 1375 (trigger_scan)
Stopped at      calculate_crc32c+0xf0:  movl    0x4(%rcx),%ebx
(full panic in panic.txt; kernel-#1 instance + full stack in dump_stack.txt)

=====================================================================
[2] FIXED KERNEL #3 (fix.diff: extract guard + scan clamp) — Sep 8 2026
=====================================================================
same image-creation + patch procedure, same trigger binary:

$ ./trigger_scan /mnt 1
trigger: SCAN_PSEUDOFS pfs_id=1 on /mnt uid=1001
ioctl returned -1 errno=5 (Input/output error) head.error=0 pfs_id=1
ioctl_exit=0
$ ./trigger_scan /mnt 1
trigger: SCAN_PSEUDOFS pfs_id=1 on /mnt uid=1001
ioctl returned -1 errno=5 (Input/output error) head.error=0 pfs_id=1
second_exit=0

guest stays up; dmesg:
hammer_btree_extract: bad record data 292 @ 90000000ffffffff

=> baseline panic GONE on the patched kernel; the forged record is
   rejected with EIO at hammer_btree_extract() before any buffer
   cache access, CRC walk, or copyout.