=== READ PATH: readdisklabel accepts OOB ===
[*] in-core disklabel64: magic=0xc4464c59 npart=3 d_total_size=33554432 d_pbase=65536 d_pstop=33554432
    part[0]: p_boffset=65536      p_bsize=1048576      end=1114112     
    part[1]: p_boffset=65536      p_bsize=100663296    end=100728832      *** OUT-OF-SLICE (readdisklabel accepted it!) ***
    part[2]: p_boffset=0          p_bsize=33554432     end=33554432    

RESULT: LEAK_CONFIRMED — in-core label contains a partition extending beyond d_total_size (readdisklabel has no structural validation)

=== OOB partition /dev/vn0s0b is accessible (reads succeed) ===
4+0 records in
4+0 records out
2048 bytes transferred in 0.000047 secs (43518912 bytes/sec)
DD_b_RC=0