##### DF-0220 — manufactured window, per-read cipher_ctx introspection #####
# guest: DragonFly 6.5-DEVELOPMENT #0 (Jul 2 2026 build), uptime ~9 min, rand_mode=csprng
# tool: csprng_force_zero window2 (in-process kmem force -> read 32B -> dump live ctx)
# command: sysctl kern.rand_mode=csprng; usched :4 ./csprng_force_zero <sym> window2 2  (x2)

== window2 (ctx dump after each read), trial 1 ==
forced state[2]; ctx after each 32B read:
blk1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ctx sigma=expa key0=523b05d3a02887f67eef8bec3f723dc2 ctr=2(0x2) ctr_hi=0
blk2: 28 95 8d 01 c7 09 6d d7 55 43 41 08 85 64 38 91 6e d1 76 e0 93 3b 02 e9 26 8d ba 09 c6 bd fb 66
  ctx sigma=expa key0=4b57cfe4765b3915a790fe924a577ebf ctr=4(0x4) ctr_hi=0
blk3: 8f 57 ab 70 01 76 3a 04 04 a3 6d 4b a6 e5 e1 a1 a6 b1 a9 ae 76 80 e4 7a 05 c5 aa 36 5c dc fa c4
  ctx sigma=expa key0=8b5a7c87c236fdb55563b26e73fb857f ctr=6(0x6) ctr_hi=0
blk4: 75 aa 59 68 da 09 2c f6 27 26 7b 69 7a 27 c6 51 e3 68 8f a2 2d 36 62 43 b3 a7 78 33 b3 7b 27 b4
  ctx sigma=expa key0=22589bb53973deb2be630fde0cff76d5 ctr=8(0x8) ctr_hi=0
== trial 2 ==
forced state[2]; ctx after each 32B read:
blk1: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ctx sigma=expa key0=523b05d3a02887f67eef8bec3f723dc2 ctr=2(0x2) ctr_hi=0
blk2: 28 95 8d 01 c7 09 6d d7 55 43 41 08 85 64 38 91 6e d1 76 e0 93 3b 02 e9 26 8d ba 09 c6 bd fb 66
  ctx sigma=expa key0=4b57cfe4765b3915a790fe924a577ebf ctr=4(0x4) ctr_hi=0
blk3: 8f 57 ab 70 01 76 3a 04 04 a3 6d 4b a6 e5 e1 a1 a6 b1 a9 ae 76 80 e4 7a 05 c5 aa 36 5c dc fa c4
  ctx sigma=expa key0=8b5a7c87c236fdb55563b26e73fb857f ctr=6(0x6) ctr_hi=0
blk4: 75 aa 59 68 da 09 2c f6 27 26 7b 69 7a 27 c6 51 e3 68 8f a2 2d 36 62 43 b3 a7 78 33 b3 7b 27 b4

# INTERPRETATION (fully reproduced offline by chain_model.py — ALL MATCH):
#  - blk1 = 0x00*32: the never-keyed, fully-zero chacha input is a fixed point.
#  - After blk1's emit (ctr 0->1), the rekey keygen runs at ctr=1 with sigma
#    STILL ABSENT (chacha_keysetup runs after keysetup material is drawn),
#    so K1 = block(sigma-less zero state, ctr=1)[0:32] = 523b05d3... -- NOT
#    plain "chacha20(key=0)" and NOT the RFC 7539 zero-key vector.
#  - blk2..4 = the deterministic chain keyed by K1..K3; every key the model
#    predicts appears verbatim in the live ctx dumps (523b05d3, 4b57cfe4,
#    8b5a7c87, 22589bb5) with ctr = 2,4,6,8 exactly as modeled.