DF-3233 run 2 — fresh boot (vm.sh reset with-src), identical image
===================================================================
$ sh /root/df3233/run.sh 0x30e00
[*] directory inode = 10624
[ino 10624] after : size=200704 db0=20000..db11=20088 ib0=21600
[sb-after] qbmask=1ffff  (blkoff(0x30e00) = 0x10e00)
/dev/vn0 on /mnt (ufs, local)
$ su -m maxx -c "/tmp/trig3233 /mnt/d"
[*] trigger: uid=1001 creat /mnt/d/zz
open: File exists
[*] survived
$ ls -l /mnt/d/zz; su -m maxx -c "touch /mnt/d/zz"
ls: /mnt/d/zz: No such file or directory
<hang>

console (panic.2.txt):
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xfffff8005a396e00
fault code = supervisor write data, page not present
instruction pointer = 0x8:0xffffffff80bca655
current process = 921
Stopped at      memset+0xd5:   repe stosq %es:(%rdi)

Same faulting instruction (memset+0xd5, IP 0xffffffff80bca655) across two
fresh boots; different fault VA — the write target follows the buffer-cache
KVA layout, as expected for a neighbour-buffer OOB write through dirbuf.