=== harness_smbfs (DF-5710) ===
== DF-5710 smbfs_vfsops.c:170/173/176 strncpy budget can be -1 ==
MNAMELEN=80 sizeof(f_mntfromname)=80 budget1(78-2)=76

case0 benign user='joe' srv='fs01' share='pub' (no guard, adjacent heap intact)
[case0 benign] budget1=76 user='joe'
[case0 benign] after user+'@': pc offset=70 budget2=72
[case0 benign] after srv+'/': pc offset=75 budget3=67 (share='pub')
[case0 benign] survived; f_mntfromname='//joe@fs01/pub'
  -> result: clean exit(0)                       [baseline]

case1 user=76*'u' -> budget2==-1 -> strncpy(dst,src,SIZE_MAX)
[case1 user-route] budget1=76 user='uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'
[case1 user-route] after user+'@': pc offset=143 budget2=-1
  -> result: SIGSEGV (write crossed guard page)  [user-route guard]

case2 user=75*'u' -> budget3==-1 on the SHARE-name strncpy
[case2 share-route] budget1=76 user='uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'
[case2 share-route] after user+'@': pc offset=142 budget2=0
[case2 share-route] after srv+'/': pc offset=143 budget3=-1 (share='pub')
  -> result: SIGSEGV (write crossed guard page)  [share-route guard]

case3 user=76*'u' with 1MB runway: unbounded pad visualization
  -> result: SIGSEGV (write crossed guard page)  [runway]
  (child zeroed everything from f_mntfromname+79 to the 1MB guard:
   kernel analogue = whole struct mount and adjacent heap zeroed)

VERDICT: any case1/case2/case3 SIGSEGV == unbounded copy reproduced
rc=0

=== harness_netmap_clamp (DF-5711) ===
bdg_basename has NUL within [0,16)? -> NO (index -1)
strlen(bdg_basename) (what any %s consumer reads): 47
printf("%s") reads: 'vale123456789abcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'

in-tree consumers of bdg_basename: ND() at netmap_vale.c:353,482
and D() at :566 -- ND/D are no-ops in release (netmap_kern.h:80-81)
-> latent non-termination, no live consumer: hardening.
rc=0