--- sys/vfs/ext2fs/ext2_bmap.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/df3216/srcmods/ext2_bmap.c	2026-09-08 16:42:33.800941642 +0000
@@ -55,6 +55,8 @@
 #include <vfs/ext2fs/ext2_extern.h>
 #include <vfs/ext2fs/ext2_mount.h>
 
+int ext2_df3216_trace = 0;
+
 /*
  * Bmap converts the logical block number of a file to its physical block
  * number on the disk. The conversion is done by using the logical block
@@ -88,6 +90,19 @@
 		error = ext2_bmaparray(ap->a_vp, lbn, &dbn, ap->a_runp,
 		    ap->a_runb);
 
+	if (ext2_df3216_trace) {
+		struct ext2mount *_ump = VTOI(ap->a_vp)->i_ump;
+
+		printf("DF3216[bmap]: loff=%lld lbn=%lld dbn=%lld err=%d "
+		    "nindir=%lu bptr=%lu seq=%lu bsize=%u fsbtodb=%u "
+		    "fiosize=%ld\n",
+		    (long long)ap->a_loffset, (long long)lbn,
+		    (long long)dbn, error, _ump->um_nindir,
+		    _ump->um_bptrtodb, _ump->um_seqinc,
+		    fs->e2fs_bsize, fs->e2fs_fsbtodb,
+		    (long)ap->a_vp->v_mount->mnt_stat.f_iosize);
+	}
+
 	if (error || dbn == (daddr_t)-1) {
 		*ap->a_doffsetp = NOOFFSET;
 	} else {
@@ -205,6 +220,13 @@
 	if (error)
 		return (error);
 
+	if (*nump > 1 && a[1].in_off >= (int)(fs->e2fs_bsize / sizeof(uint32_t)))
+		printf("DF3216[read-OOB]: lbn=%ld levels=%d in_off=%d >= "
+		    "nindir_real=%d (stale nindir=%lu, bsize=%u, bptr=%lu)\n",
+		    (long)bn, *nump, a[1].in_off,
+		    (int)(fs->e2fs_bsize / sizeof(uint32_t)),
+		    MNINDIR(ump), fs->e2fs_bsize, ump->um_bptrtodb);
+
 	num = *nump;
 	if (num == 0) {
 		*bnp = blkptrtodb(ump, ip->i_db[bn]);
--- sys/vfs/ext2fs/ext2_balloc.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/df3216/srcmods/ext2_balloc.c	2026-09-08 16:42:33.812941488 +0000
@@ -150,6 +150,20 @@
 	pref = 0;
 	if ((error = ext2_getlbns(vp, lbn, indirs, &num)) != 0)
 		return (error);
+	{
+		int _i;
+
+		for (_i = 0; _i < num; _i++)
+			if (indirs[_i].in_off >=
+			    (int)(fs->e2fs_bsize / sizeof(uint32_t)))
+				printf("DF3216[balloc-OOB]: lbn=%llu level=%d "
+				    "in_off=%d >= nindir_real=%d (stale "
+				    "nindir=%lu, bsize=%u)\n",
+				    (unsigned long long)lbn, _i,
+				    indirs[_i].in_off,
+				    (int)(fs->e2fs_bsize / sizeof(uint32_t)),
+				    MNINDIR(ump), fs->e2fs_bsize);
+	}
 #ifdef INVARIANTS
 	if (num < 1)
 		panic("ext2_balloc: ext2_getlbns returned indirect block");
@@ -264,6 +278,13 @@
 		nbp->b_bio2.bio_offset = fsbtodoff(fs, nb);
 		if (flags & BA_CLRBUF)
 			vfs_bio_clrbuf(nbp);
+		if (indirs[i].in_off >= (int)(fs->e2fs_bsize / sizeof(uint32_t)))
+			printf("DF3216[WRITE-OOB]: bap[%d] <- %llu at "
+			    "b_data+4*%d=%d (buffer size %ld, b_data=%p) "
+			    "== OOB WRITE past buffer end\n",
+			    indirs[i].in_off, (unsigned long long)nb,
+			    indirs[i].in_off, indirs[i].in_off * 4,
+			    (long)bp->b_bufsize, bp->b_data);
 		bap[indirs[i].in_off] = htole32(nb);
 		/*
 		 * If required, write synchronously, otherwise use
--- sys/vfs/ext2fs/ext2_vfsops.c	2026-06-29 12:51:19.000000000 +0000
+++ /tmp/opencode/df3216/srcmods/ext2_vfsops.c	2026-09-08 16:42:33.812941488 +0000
@@ -822,6 +822,14 @@
 		brelse(bp);
 		return (error);
 	}
+	printf("DF3216[reload]: ADOPTED bsize=%u bshift=%u fsbtodb=%u "
+	    "fsize=%u ipg=%u gcount=%u BUT um_nindir=%lu um_bptrtodb=%lu "
+	    "um_seqinc=%lu f_iosize=%ld (divergence!)\n",
+	    fs->e2fs_bsize, fs->e2fs_bshift, fs->e2fs_fsbtodb,
+	    fs->e2fs_fsize, fs->e2fs_ipg, fs->e2fs_gcount,
+	    VFSTOEXT2(mp)->um_nindir, VFSTOEXT2(mp)->um_bptrtodb,
+	    VFSTOEXT2(mp)->um_seqinc,
+	    (long)mp->mnt_stat.f_iosize);
 #ifdef UNKLAR
 	if (fs->fs_sbsize < SBSIZE)
 		bp->b_flags |= B_INVAL;