# Test Case: Invalid Superblock Magic

**Test ID**: TC112-invalid-superblock
**Category**: Error Handling
**Priority**: Critical

## Objective

Verify rejection of an invalid EROFS magic at the real field while provider
length and all suffix bytes covered by repo22's production checksum verifier
remain unchanged.

## Fixture Qualification

```sh
work=$(mktemp -d /tmp/repo22-tc112.XXXXXX)
tests/prepare_error_fixtures.sh "$work/fixtures"
od -An -tx4 -j 1024 -N 4 "$work/fixtures/bad-magic.erofs"
python3 tests/erofs_fixture.py inspect "$work/fixtures/bad-magic.erofs"
grep '^bad-magic ' "$work/fixtures/fixture-evidence.txt"
wc -c "$work/fixtures/valid-plain.erofs" \
  "$work/fixtures/bad-magic.erofs"
sha256 -q "$work/fixtures/bad-magic.erofs"
```

The mutator asserts magic `0xe0f5e1e2` at byte 1024 and replaces it with
`0x21444142`. It intentionally leaves the stored checksum unchanged. The
canonical checksum over the changed magic is invalid, but the production
fixed-magic suffix calculation over `[1032,4096)` remains valid because no
suffix byte changed. Magic validation occurs first.

## FreeBSD Procedure

```sh
mkdir "$work/mnt"
unit=$(mdconfig -a -t vnode -f "$work/fixtures/bad-magic.erofs")
set +e
mount -t erofs -o ro "/dev/$unit" "$work/mnt" \
  >"$work/mount.out" 2>"$work/mount.err"
status=$?
set -e
test "$status" -ne 0
set +e
truss -o "$work/mount.truss" mount -t erofs -o ro "/dev/$unit" \
  "$work/mnt" >/dev/null 2>&1
set -e
grep -E 'nmount.*ERR#22' "$work/mount.truss"
! mount -p | awk -v path="$work/mnt" '$2 == path { found=1 }
  END { exit found ? 0 : 1 }'
mdconfig -d -u "${unit#md}"
```

## Expected Results

Mount returns errno 22 (`EINVAL`) before root vnode creation. No panic, mount,
or md consumer remains.