=== DF-1085 harness: crom_parse_text write-underflow (textleaf->crc_len < 2) ===
fwcrom.c:215  qlen = textleaf->crc_len - 2;   (crc_len is u_int32_t:16, BIT16x2)
fwcrom.c:224  buf[qlen * 4] = 0;              (qlen=-2 -> buf[-8]; qlen=-1 -> buf[-4])

[crc_len=0] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=0
[crc_len=0] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 
[crc_len=0] buf [0..3]: 28 6e 75 6c (sentinel was BB BB BB BB)
[crc_len=0] canary intact: no underflow write (crc_len guard fired).

[crc_len=1] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=1
[crc_len=1] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 
[crc_len=1] buf [0..3]: 28 6e 75 6c (sentinel was BB BB BB BB)
[crc_len=1] canary intact: no underflow write (crc_len guard fired).

[crc_len=2 (legal minimum)] root dir entry[0]: key=0x81 val=0x000001; leaf crc_len=2
[crc_len=2 (legal minimum)] pre  bytes: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 
[crc_len=2 (legal minimum)] buf [0..3]: 00 bb bb bb (sentinel was BB BB BB BB)
[crc_len=2 (legal minimum)] canary intact: no underflow write (crc_len guard fired).

=== summary ===
crc_len=0 -> no bug
crc_len=1 -> no bug
crc_len=2 -> no bug (control: must be 'no bug')

>>> OVERALL: canary intact — underflow is guarded.