==== PATCHED-kernel RUN (single-fix kernel: 6.5-DEVELOPMENT #1, Tue Jul 14 19:31:57 UTC 2026;
                          sha256 c9a066a786423ba091a6ab3aecd62823735c689f890b67e082362f486d7b8d43) ====

$ ./einval_noop
read(fd,buf,SIZE_MAX) = -1, errno=22 (EINVAL)
[note] read already returns EINVAL on this kernel (maybe fixed); skipping write-hang probe.
RC=0

$ ./write_only            (separate probe for the sys_write path)
PATCHED write(fd,buf,SSIZE_MAX+1) = -1, errno=22 (EINVAL)

run 2 (write_only): same -> -1, errno=22 (EINVAL)
run 3 (einval_noop): same -> read returns -1/EINVAL, no probe needed

==== INTERPRETATION ====
On the patched kernel BOTH the read and the write paths now return -1/EINVAL
for nbyte > SSIZE_MAX, exactly as POSIX requires and exactly as the sibling
sys_extpread always did.  Crucially the write path no longer hangs: the
process exits promptly and the guest stays up (no DoS).  The fix is
deterministic across 3 runs.

Compare to the unpatched baseline (run.log):
  read  -> 0, errno=0 (NOT EINVAL)              [correctness bug]
  write -> HUNG in uninterruptible kernel loop   [local DoS]