# Test Case: Xattr declared-image bounds

**Test ID**: TC137-xattr-declared-image-bounds
**Fixtures**: `basic.erofs`, `bad-shared-declared-bounds.erofs`, `bad-prefix-declared-bounds.erofs`

## Objective

Ensure shared and prefix reads are bounded by superblock `blocks`, even when
the provider contains a valid-looking appended sentinel. Require manifest
provider/declared sizes, sentinel offsets, redirected ID/start, and hashes.

## Manual steps

Run three independent cycles:

```sh
# basic.erofs control
getextattr -qq -x user shared_key /mnt/repo22-g4/shared-a
getextattr -qq -x user local /mnt/repo22-g4/shared-a

# bad-shared-declared-bounds.erofs
stat -f 'size=%z' /mnt/repo22-g4/shared-a
getextattr -qq -x user local /mnt/repo22-g4/shared-a
truss -o /tmp/tc137-shared.truss getextattr -qq user shared_key \
  /mnt/repo22-g4/shared-a
grep extattr_get_file /tmp/tc137-shared.truss

# bad-prefix-declared-bounds.erofs
truss -f -o /tmp/tc137-prefix.truss mount -t erofs -o ro \
  /dev/${unit} /mnt/repo22-g4
grep nmount /tmp/tc137-prefix.truss
```

## Expected results

Control passes. The shared sentinel get and prefix mount return `EINTEGRITY`
(97); normal data and `local` remain readable. Sentinel bytes never appear.