update

tests/TC157-explicit-extent-order-validation.md

@@ -0,0 +1,55 @@
+# Test Case: Explicit Extent Global Ordering Validation
+
+**Test ID**: TC157-explicit-extent-order-validation
+**Category**: Compression Mapping
+**Priority**: Critical
+**Regression**: Binary search over an unvalidated explicit extent table can silently select the wrong mapping
+
+## Objective
+
+Verify that every 16-byte and 32-byte explicit extent table is validated once,
+before binary search, for globally strict `lstart` ordering and logical bounds.
+Descending, duplicate, and cross-search-branch violations must return positive
+FreeBSD `EINTEGRITY` without reading the referenced compressed payload.
+
+## Fixtures
+
+Generate and self-check all final-review fixtures on the host:
+
+```sh
+python3 tests/final_review_fixtures.py make \
+  --output /work/build/repo22-final-review-fixtures
+```
+
+For each record size, the helper emits `descending`, `duplicate`, and
+`cross-branch` images. The manifest records the complete `lstart` list, old
+binary-search indices, table offsets, payload offset, and SHA256. The
+cross-branch shape `[0, 8192, 4096, 12288]` is queried at 4096; the old search
+visits records 2 and 3 but never record 1, so a hit-neighbor-only check is not
+sufficient.
+
+## Procedure
+
+1. Build and load the exact `WITH_ZSTDIO=0` module on FreeBSD 15.
+2. For each of the six images, attach an md provider and mount it read-only.
+3. Before any lookup of `/extent.bin`, run:
+
+   ```sh
+   final_review_probe expect-stat-error /mnt/repo22-final/extent.bin 97
+   ```
+
+4. Wrap the command with `io:::start`, filtered to that md unit. Require a raw
+   `dd` positive control to report the manifest payload offset 4096, then require
+   zero events at offset 4096 during every failing target lookup.
+5. Repeat one case to confirm the same positive errno, compare dmesg, and clean
+   the mount, md unit, EROFS KLD, and DTrace modules.
+
+## Expected Results
+
+- All six target lookups return `EINTEGRITY` (97).
+- Both record sizes reject descending and duplicate `lstart` values globally.
+- Cross-branch corruption is rejected even though the old binary search would
+  not visit the preceding offending record.
+- The payload-offset positive control fires and all six failing operations have
+  zero payload-offset GEOM events.
+- No wrapped, negative, or Linux-style errno is returned.