# Test Case: Explicit Extent Global Ordering Validation

**Test ID**: TC157-explicit-extent-order-validation
**Category**: Compression Mapping
**Priority**: Critical
**Regression**: Binary search over an unvalidated explicit extent table can silently select the wrong mapping

## Objective

Verify that every 16-byte and 32-byte explicit extent table is validated once,
before binary search, for globally strict `lstart` ordering and logical bounds.
Descending, duplicate, and cross-search-branch violations must return positive
FreeBSD `EINTEGRITY` without reading the referenced compressed payload.

## Fixtures

Generate and self-check all final-review fixtures on the host:

```sh
python3 tests/final_review_fixtures.py make \
  --output /work/build/repo22-final-review-fixtures
```

For each record size, the helper emits `descending`, `duplicate`, and
`cross-branch` images. The manifest records the complete `lstart` list, old
binary-search indices, table offsets, payload offset, and SHA256. The
cross-branch shape `[0, 8192, 4096, 12288]` is queried at 4096; the old search
visits records 2 and 3 but never record 1, so a hit-neighbor-only check is not
sufficient.

## Procedure

1. Build and load the exact `WITH_ZSTDIO=0` module on FreeBSD 15.
2. For each of the six images, attach an md provider and mount it read-only.
3. Before any lookup of `/extent.bin`, run:

   ```sh
   final_review_probe expect-stat-error /mnt/repo22-final/extent.bin 97
   ```

4. Wrap the command with `io:::start`, filtered to that md unit. Require a raw
   `dd` positive control to report the manifest payload offset 4096, then require
   zero events at offset 4096 during every failing target lookup.
5. Repeat one case to confirm the same positive errno, compare dmesg, and clean
   the mount, md unit, EROFS KLD, and DTrace modules.

## Expected Results

- All six target lookups return `EINTEGRITY` (97).
- Both record sizes reject descending and duplicate `lstart` values globally.
- Cross-branch corruption is rejected even though the old binary search would
  not visit the preceding offending record.
- The payload-offset positive control fires and all six failing operations have
  zero payload-offset GEOM events.
- No wrapped, negative, or Linux-style errno is returned.