# Test Case: Vget with Invalid NID

**Test ID**: TC013-vget-invalid

## Objective

Verify a checksum-valid directory entry that points outside the image reaches
the cold lookup/vget path and fails consistently with `EINTEGRITY`.

## Fixture

Use `images/invalid-dirent-nid.erofs`. `fixture-evidence.txt` records the exact
dirent offset, old NID, out-of-range NID, and valid recomputed CRC. Compile
`tests/read_probe.c` in the guest.

## Procedure

Mount the image without first listing the root, then run:

```sh
./read_probe expect-error "$mnt/invalid-target.txt" 97
./read_probe expect-error "$mnt/invalid-target.txt" 97
set +e
truss -o /tmp/tc013.truss stat "$mnt/invalid-target.txt"
rc=$?
set -e
printf 'stat_rc=%d\n' "$rc"
tail -20 /tmp/tc013.truss
```

Record dmesg before/after, remove the trace, then unmount and detach.

## Expected Results

- Mount succeeds because only the child dirent is malformed.
- Both cold/repeated opens fail at pathname acquisition with FreeBSD errno 97
  (`EINTEGRITY`); `truss` shows the same syscall errno.
- The second failure is not converted to `ENOENT`; no panic or stale vnode
  appears, and cleanup succeeds.