BUILD_EXIT=0
=== A: benign metadata (forward walk OK) (metadata @ 0x7fffffdfd940, 6 words) ===
  step 0: type=0x00000001 len(hdr[1])=0x00000006 -> next(int)=16 (0x10) [offset +0]
  step 1: terminator reached normally at offset +16

=== B: hdr[1]=0x80000000 -> next NEGATIVE (backward walk) (metadata @ 0x7fffffdfd920, 4 words) ===
  step 0: type=0x00000001 len(hdr[1])=0x80000000 -> next(int)=-2147483640 (0x80000008) [offset +0]
    !!! next<0 => curp walks BACKWARD past preload_metadata => OOB read before blob
  step 1: WOULD READ at offset -2147483640 -- *** BEFORE *** the 16-byte blob
    => kernel reads memory that PRECEES preload_metadata (OOB read), or loops here forever (next==0)

=== C: hdr[1]=0xFFFFFFF8 -> next==0 (boot hang) (metadata @ 0x7fffffdfd930, 4 words) ===
  step 0: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 1: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 2: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 3: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 4: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 5: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 6: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 7: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  step 8: type=0x00000001 len(hdr[1])=0xfffffff8 -> next(int)=0 (0x0) [offset +0]
    !!! next==0 => curp never advances => INFINITE LOOP (boot hang)
  ... (stopping after 8 steps)

RUN_EXIT=0