doff_t (int32) truncation of crafted directory i_size >= 2^31 yields negative dp->i_offset -> ext2_write KASSERT panic on INVARIANTS kernels (EINVAL elsewhere)

Summary

endsearch = roundup2(dp->i_size, DIRBLKSIZ) and dp->i_offset = roundup2(dp->i_size, DIRBLKSIZ) truncate a crafted uint64 directory i_size (e.g. 0x80000000) into negative int32 doff_t: the search loop silently skipped (:424/:428), CREATE falls into slotstatus==NONE with dp->i_offset = INT32_MIN (:496), and ext2_direnter -> ext2_add_first_entry passes the negative offset to VOP_WRITE hitting ext2_write's KASSERT(uio_offset >= 0) - panic on INVARIANTS/debug builds (the audit guest's stock config); production EINVAL via maxfilesize. Traced certainty, not guest-run (Low). Fix: clamp directory offsets / reject oversized directory inodes at ext2_iget.