BUILD-OK
== FIXED caller (pe - pc > 2 guards): hostile cases must now survive ==
MNAMELEN=80 sizeof(f_mntfromname)=80 budget1(78-2)=76

case0 benign user='joe' srv='fs01' share='pub' (no guard, adjacent heap intact)
[case0 benign] budget1=76 user='joe'
[case0 benign] after user: pc offset=69 budget2=73
[case0 benign] after user+'@': pc offset=70 budget2=72
[case0 benign] after srv: pc offset=74 budget3=68
[case0 benign] after srv+'/': pc offset=75 budget3=67 (share='pub')
[case0 benign] survived; f_mntfromname='//joe@fs01/pub'
  -> result: clean exit(0)                       [baseline]

case1 user=76*'u' -> budget2==-1 -> strncpy(dst,src,SIZE_MAX)
[case1 user-route] budget1=76 user='uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'
[case1 user-route] after user: pc offset=142 budget2=0
[case1 user-route] survived; f_mntfromname='//uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'
  -> result: clean exit(0)                       [user-route guard]

case2 user=75*'u' -> budget3==-1 on the SHARE-name strncpy
[case2 share-route] budget1=76 user='uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'
[case2 share-route] after user: pc offset=141 budget2=1
[case2 share-route] after user+'@': pc offset=142 budget2=0
[case2 share-route] after srv: pc offset=142 budget3=0
[case2 share-route] survived; f_mntfromname='//uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu@'
  -> result: clean exit(0)                       [share-route guard]

case3 user=76*'u' with 1MB runway: unbounded pad visualization
  -> result: clean exit(0)                       [runway]
  (child zeroed everything from f_mntfromname+79 to the 1MB guard:
   kernel analogue = whole struct mount and adjacent heap zeroed)

VERDICT (fixed): every case clean exit + NUL-terminated result == fix effective
rc=0

--- patch dry-run (smbfs) ---
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/vfs/smbfs/smbfs_vfsops.c
|+++ b/sys/vfs/smbfs/smbfs_vfsops.c
--------------------------
Patching file sys/vfs/smbfs/smbfs_vfsops.c using Plan A...
patch: **** malformed patch at line 31:  	}
Hmm...  Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- a/sys/net/netmap/netmap_vale.c
|+++ b/sys/net/netmap/netmap_vale.c
--------------------------
Patching file sys/net/netmap/netmap_vale.c using Plan A...
patch: **** malformed patch at line 12: