=== DF-4140: unbounded drive freelist growth -> heap OOB write -> controlled pointer corruption ===
Trigger: crafted vinum drive whose config defines 60 one-sector subdisks at
2-sector pitch (each placement fragments one free-list entry into two =>
freelist_entries grows 1 -> ~61 in an array allocated for 16 entries).

After 3 read/resetconfig cycles the corrupted 256-byte zone is consumed:

Fatal trap 12: page fault while in kernel mode
fault virtual address	= 0x163                      <- 355 == an attacker-chosen sdend value (300+2*27+1)
fault code		= supervisor read data, page not present
instruction pointer	= 0x8:0xffffffff809e16ed
current process		= Idle
Stopped at      prop_object_release+0x3d:  movq (%rbx),%rax   <- adjacent 256B object (libprop) clobbered

The faulting address IS the value written past the end of drive->freelist:
proof that the overflow content (u64 offset/sectors pairs chosen by the
attacker in the config) lands in live adjacent kernel objects.