=== math proof: the wrap is equivalent to the signed op ===
offset=22 length=257 (offset<length: underflow branch active)

field        buggy-path      intended        expected        verdict
begin_envv   0x1016         0x1016         0x1016         ALL MATCH
endp         0x1016         0x1016         0x1016         ALL MATCH
space        262122         262122         262122         ALL MATCH

begin_envv = buf + 22  (well inside the ARG_MAX+PATH_MAX buffer)
=> the size_t wrap is mathematically equivalent to the signed op.
=> NO wild pointer, NO corruption, NO panic. FALSE POSITIVE.

=== argv[0] length = 256 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 1024 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 4096 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 32768 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 131072 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 262140 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== enhanced: large-environment bcopy stress (forces real byte shift) ===
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=256 nenv=200 envlen=1024 -- bcopy+underflow harmless
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=4096 nenv=400 envlen=256 -- bcopy+underflow harmless
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=32768 nenv=100 envlen=512 -- bcopy+underflow harmless
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=5000 nenv=40 envlen=6000 -- bcopy+underflow harmless
RUN_OK (no panic at any length/env -- false positive confirmed)
=== (a) max-delta single-shot: /bin/sh + /tmp/z, argv0=262144 ===
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
OK: 50x exec, argv0=262144 empty-env (d~262129), bad=0
=== (b) nonexistent interp #!/a: imgact arithmetic alone ===
OK: 50x exec, interp #!/a argv0=262144, bad=0
=== (c) large env + max delta (argv0 sized to leave env room) ===
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
TRIGGER3_RAN
OK: 50x exec, argv0=215024 + 80 env x ~510B, bad=0
=== (d) parallel hammer: 8 workers x 75 execs, mixed lengths ===
OK: 8x75 parallel execs, failed_workers=0
TRIGGER3_OK: 700 underflow execs, max delta, no crash no signal