### DF-5497 fix validation — fix.diff applied to guest /usr/src; module AND userspace model rebuilt from the patched source

## [1] userspace guard-page model (patched fwcrom.c): subtests A/B no longer fault — the wild directory pointer is rejected BEFORE the dereference; walk completes cleanly (exit 0). On baseline these faulted at the predicted OOB addresses.
DF-5497 userspace model: production fwcrom.c vs guard-page ROM
subtest A: V=300, dir read at rom+1224 (guard page, +200 past ROM)
  walk start (depth=0), dir read expected at rom+1224
  walk finished cleanly, depth=-1 (no fault)
  -> child exit 0 (UNEXPECTED)
subtest B: V=0xffffff, dir read at rom+0x4000014 (+64 MB reach)
  walk start (depth=0), dir read expected at rom+67108884
  walk finished cleanly, depth=-1 (no fault)
  -> child exit 0 (UNEXPECTED)
subtest C: V=100, dir read at rom+424 (in-ROM control)
  walk start (depth=0), dir read expected at rom+424
  walk finished cleanly, depth=-1 (no fault)
  -> child exit 0 (EXPECTED)
patched model exit: 0
case1 len=72 (max): ROM quadlets=28, published leaf header=0x0014d0fb (crc_len field=20, IEEE-1212-correct=20), PATTERN absent
case2 len=68 (control, exact fit): strlen=68 builder crc_len=19 (data holds 21 quads; 1+crc_len=20 quads will be copied/CRC'd)

## [2] KLD mode 1 (patched): oracle lines 4 -> 0 (no OOB neighbor reads at all)
## [3] KLD mode 2 (patched): NO panic, walk finishes, guest stays up

/root/df5497/df5497.ko
kern.df5497_mode: 1 -> 1
kern.df5497_fire: 0 -> 1
kern.df5497_mode: 1 -> 2
kern.df5497_fire: 1 -> 1
BOTH_MODES_SURVIVED
DF5497 harness loaded (production fwcrom.c)
DF5497 mode1: 5 descents at +1224..+16408 bytes past the 1024-byte ROM, slab groomed with crc_len=1 pattern: expect 'crom_next: bound check failed' oracle lines, no fault
DF5497 mode1: walk finished after 64 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)
DF5497 mode2: 16 descents at +4 MB..+64 MB past the ROM in 4 MB steps: expect oracle lines then Fatal trap 12 in dfh_crom_next (unmapped kernel_map page)
crom_next: bound check failed
DF5497 mode2: walk finished after 64 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)

## full guest dmesg tail after both patched KLD runs:
cd0 at ata1 bus 0 target 0 lun 0
cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI-0 device 
cd0: 16.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present
Mounting root from hammer2:vbd0s1d
hammer2_mount: root devstr="vbd0s1d"
hammer2_mount: device="vbd0s1d" label="ROOT" rdonly=1
hammer2_ondisk: "/dev/vbd0s1d" zone=2 id=0 offset=0x0000000000000000 size=0x000000063f000000
hammer2_mount: hmp=0xfffff8008fae0000 pmp=0xfffff80090280000
DMA space used: 13580k, remaining available: 131072k
Mounting devfs
hammer2_mount: "vbd0s1d": no recovery needed
hammer2: enable read/write
HAMMER2: VOLDATA DUMP
HAMMER2: INITIATE SPANs
swap low/high-water marks set to 41940/62910
DF5497 harness loaded (production fwcrom.c)
DF5497 mode1: 5 descents at +1224..+16408 bytes past the 1024-byte ROM, slab groomed with crc_len=1 pattern: expect 'crom_next: bound check failed' oracle lines, no fault
DF5497 mode1: walk finished after 64 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)
DF5497 mode2: 16 descents at +4 MB..+64 MB past the ROM in 4 MB steps: expect oracle lines then Fatal trap 12 in dfh_crom_next (unmapped kernel_map page)
crom_next: bound check failed
DF5497 mode2: walk finished after 64 crom_next() calls, depth=-1 -- UNEXPECTEDLY no fault (all probe offsets mapped)