=== Baseline (#0 unpatched) stress: 5 sequential runs ===
Each run: craft the malformed ELF, exec it. EI_OSABI=200 so brand can ONLY
match via the PT_NOTE path. With note_overflow not checking n_descsz, the
truncated brandnote matches, bsd_trans_osrel reads the missing descriptor
OOB at image_header+4096..4100 (past the mapped lwbuf page), brand is
selected, execve proceeds; the binary has no PT_LOAD so it SIGSEGVs at
entry=0. The OOB read happens silently every time (adjacent kernel page
is mapped) - no panic.

RC=139#Segmentation fault (core dumped)#
Segmentation fault (core dumped)#RC=139#
Segmentation fault (core dumped)#RC=139#
RC=139#Segmentation fault (core dumped)#
Segmentation fault (core dumped)#RC=139#