DF-3232 run 2 — BNO=6000 (nonzero byte past bitmap, still inside buffer)
=========================================================================
console (guest down, full tail in panic2.txt):
dev = vn0, block = 6000, fs = /mnt
panic: ffs_blkfree: freeing free block
Trace:
ffs_blkfree_cg() at ffs_blkfree_cg+0x636
ffs_blkfree() at ffs_blkfree+0x111
ffs_truncate() at ffs_truncate+0x5a9
ufs_setattr() at ufs_setattr+0x219
vop_setattr() at vop_setattr+0x9c

ffs_isfreeblock (ffs_subr.c:250) read cp[6000] — 368 bytes past the 5632-byte
bitmap, inside the mapped cg buffer (cluster-map region, nonzero for a fresh
fs) — and the kernel used that out-of-bounds byte as the 'block still free?'
oracle, panicking because it read a nonzero kernel byte where the bitmap ends.