Day-of-month 0 causes unsigned underflow in fattime2timespec (crafted FAT image)

Summary

fattime2timespec(:233) day=(dd&0x1f)-1. FAT day=0 -> 0-1 wraps UINT_MAX. Downstream arithmetic wraps -> garbage timespec. Reachable: msdosfs passes de_MDate from on-disk FAT entry. Crafted USB image de_MDate low 5 bits=0 -> wrong mtime on stat().