=== DF-1085 harness: crom_parse_text write-underflow (textleaf->crc_len < 2) ===
fwcrom.c:215  qlen = textleaf->crc_len - 2;   (crc_len is u_int32_t:16, BIT16x2)
fwcrom.c:224  buf[qlen * 4] = 0;              (qlen=-2 -> buf[-8]; qlen=-1 -> buf[-4])

[crc_len=0] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=0
[crc_len=0] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 00 a5 a5 a5 a5 a5 a5 a5 
[crc_len=0] buf [0..3]: bb bb bb bb (sentinel was BB BB BB BB)
[crc_len=0] >>> BUG CONFIRMED: pre[8] (== buf[-8]) was zeroed by buf[qlen*4]=0 with qlen=-2
[crc_len=0] >>> In the SBP-2 caller this byte aliases the high byte of sdev->free_ocbs.tqh_last (sbp.c:186), corrupting a
[crc_len=0] >>> kernel heap pointer later dereferenced by STAILQ_INSERT_TAIL/REMOVE on the free-OCB queue.

[crc_len=1] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=1
[crc_len=1] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 00 a5 a5 a5 
[crc_len=1] buf [0..3]: bb bb bb bb (sentinel was BB BB BB BB)
[crc_len=1] >>> BUG CONFIRMED: pre[12] (== buf[-4]) was zeroed by buf[qlen*4]=0 with qlen=-1
[crc_len=1] >>> In the SBP-2 caller this byte aliases the high byte of sdev->free_ocbs.tqh_last (sbp.c:186), corrupting a
[crc_len=1] >>> kernel heap pointer later dereferenced by STAILQ_INSERT_TAIL/REMOVE on the free-OCB queue.

[crc_len=2 (legal minimum)] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=2
[crc_len=2 (legal minimum)] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 
[crc_len=2 (legal minimum)] buf [0..3]: 00 bb bb bb (sentinel was BB BB BB BB)
[crc_len=2 (legal minimum)] canary intact: no underflow write (crc_len guard fired).

=== summary ===
crc_len=0 -> BUG (underflow write)
crc_len=1 -> BUG (underflow write)
crc_len=2 -> no bug (control: must be 'no bug')

>>> OVERALL: BUG CONFIRMED — crom_parse_text writes out of bounds when crc_len < 2.