Fix two bugs the Fedora move exposed

Neither is Fedora-specific. A different host and a freshly built
userland simply drove code that Windows never reached.

tools/mkfs.c did not compile at all. The DT_UNKNOWN/DT_DIR/DT_REG
fallbacks sat above <dirent.h>, so on glibc -- which spells them as
enumerators -- the #ifndef asked before the header was read, always
answered "missing", and then the header's own enum expanded to
`enum { 0 = 0, ... }`. Move the fallbacks below the include. The
include cannot move up instead: it has to follow the #undef that ends
the `#define dirent schfs_dirent` block.

getstackpcs() page-faulted. It dereferenced rbp[1] without validating
rbp, and the guard rejected 0xffffffff -- dead code on x86-64, already
caught by the KERNBASE test -- while the value that actually turns up
is all-ones, which is above KERNBASE. rbp[1] then wrapped to 0x7 and
took trap 14. `cp` panicked the kernel every time. Bound rbp from
above and require 8-byte alignment.

That second one masks other bugs: getcallerpcs() runs on every lock
acquisition and again from the trap handler, so a walker that can
fault replaces a real diagnosis with a bogus one.

Baseline on the Fedora laptop is now green: make ports, make,
make schfs-check including the round-trip that had never run, and
bootcheck at 27/27 plus 108 [ok] across the extended suites.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kernel/core/spinlock.c

@@ -70,7 +70,24 @@ getstackpcs(addr_t *rbp, addr_t pcs[])
   int i;
 
   for(i = 0; i < 10; i++){
-    if(rbp == 0 || rbp < (addr_t*)KERNBASE || rbp == (addr_t*)0xffffffff)
+    // This walks a frame chain that may be garbage -- it runs from
+    // getcallerpcs() on every lock acquisition, and again from the trap
+    // handler, where the thing being diagnosed is often the reason the stack
+    // is unwalkable. A fault here replaces the real diagnosis with a second,
+    // more confusing one, so every dereference is checked first.
+    //
+    // The old test also compared against 0xffffffff, which on x86-64 is
+    // unreachable: it is far below KERNBASE and the check above already
+    // rejected it. The value that actually turns up is all-ones,
+    // 0xffffffffffffffff, which is *above* KERNBASE and sailed straight
+    // through -- rbp[1] then wraps to address 0x7 and page-faults. Bound rbp
+    // from above rather than naming another magic constant, so any frame
+    // pointer near the top of the address space is rejected whatever it is.
+    if(rbp == 0 || rbp < (addr_t*)KERNBASE || (addr_t)rbp > (addr_t)-16)
+      break;
+    // A frame pointer is 8-byte aligned. An unaligned one is not a frame,
+    // and following it walks off into arbitrary memory.
+    if(((addr_t)rbp & 7) != 0)
       break;
     pcs[i] = rbp[1];
     rbp = (addr_t*)rbp[0];