# DF-3254 -- verification pack

Finding: hammer_ioc_dedup validates the data zone AFTER extract has dereferenced it

Status: **reproduced** / impact **panic** / confidence certain

## What was run
guest: cc -O -o patch_doff patch_doff.c; cc -O -I/usr/src/sys/vfs/hammer -o dedup_trigger dedup_trigger.c; image: newfs_hammer + a data file + synctid, offline-patch a DATA leaf data_offset to 0x100000 with CRC fix

## How to reproduce
```
guest: mount_hammer /dev/vn0 /mnt/h1 && ./dedup_trigger /mnt/h1 --copy h1.img <element-offset>
```

## Expected
panic: assertion HAMMER_ZONE(buf_offset) != 0 failed in _hammer_bread (see panic.txt); with data_offset exactly 0 the ioctl instead returns INVALID_ZONE harmlessly

See VERDICT.md for the full narrative and verdict.json for the persisted
machine verdict. Artifacts: patch_doff.c, dedup_trigger.c, panic.txt, run.log.