update

tests/TC137-xattr-declared-image-bounds.md

@@ -0,0 +1,37 @@
+# Test Case: Xattr declared-image bounds
+
+**Test ID**: TC137-xattr-declared-image-bounds
+**Fixtures**: `basic.erofs`, `bad-shared-declared-bounds.erofs`, `bad-prefix-declared-bounds.erofs`
+
+## Objective
+
+Ensure shared and prefix reads are bounded by superblock `blocks`, even when
+the provider contains a valid-looking appended sentinel. Require manifest
+provider/declared sizes, sentinel offsets, redirected ID/start, and hashes.
+
+## Manual steps
+
+Run three independent cycles:
+
+```sh
+# basic.erofs control
+getextattr -qq -x user shared_key /mnt/repo22-g4/shared-a
+getextattr -qq -x user local /mnt/repo22-g4/shared-a
+
+# bad-shared-declared-bounds.erofs
+stat -f 'size=%z' /mnt/repo22-g4/shared-a
+getextattr -qq -x user local /mnt/repo22-g4/shared-a
+truss -o /tmp/tc137-shared.truss getextattr -qq user shared_key \
+  /mnt/repo22-g4/shared-a
+grep extattr_get_file /tmp/tc137-shared.truss
+
+# bad-prefix-declared-bounds.erofs
+truss -f -o /tmp/tc137-prefix.truss mount -t erofs -o ro \
+  /dev/${unit} /mnt/repo22-g4
+grep nmount /tmp/tc137-prefix.truss
+```
+
+## Expected results
+
+Control passes. The shared sentinel get and prefix mount return `EINTEGRITY`
+(97); normal data and `local` remain readable. Sentinel bytes never appear.