=== BASELINE RUN: unpatched audit kernel #0 (Thu Jul 2 06:02:54 UTC 2026) ===
=== math proof: the wrap is equivalent to the signed op ===
offset=22 length=257 (offset<length: underflow branch active)

field        buggy-path      intended        expected        verdict
begin_envv   0x1016         0x1016         0x1016         ALL MATCH
endp         0x1016         0x1016         0x1016         ALL MATCH
space        262122         262122         262122         ALL MATCH

begin_envv = buf + 22  (well inside the ARG_MAX+PATH_MAX buffer)
=> the size_t wrap is mathematically equivalent to the signed op.
=> NO wild pointer, NO corruption, NO panic. FALSE POSITIVE.

=== argv[0] length = 256 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 1024 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 4096 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 32768 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 131072 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

=== argv[0] length = 262140 ===
DF0243_SCRIPT_RAN
DF0243_CHILD_EXIT code=0 (0=script ran /bin/sh; 127=execve failed errno-path)
DF0243_NO_PANIC: script executed normally -- underflow did not crash

RUN_OK (no panic at any length -- false positive confirmed)
RUN_EXIT=0

=== ENHANCED trigger2: large-environment bcopy stress (underflow branch active) ===
=== underflow branch + large env: argv0=256, 200 env vars x 1024 bytes ===
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=256 nenv=200 envlen=1024 -- bcopy+underflow harmless
EXIT=0
=== argv0=4096, 400 env vars x 256 bytes ===
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=4096 nenv=400 envlen=256 -- bcopy+underflow harmless
EXIT=0
=== argv0=32768, 100 env vars x 512 bytes ===
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=32768 nenv=100 envlen=512 -- bcopy+underflow harmless
EXIT=0
=== precisely-tuned: argv0=5000, 40 env vars x 6000 bytes (~245KB total, under ARG_MAX) ===
DF0243_ENV_OK argv=0 sentinel_intact
DF0243_CHILD_EXIT code=0 (0=script ran with env intact)
DF0243_NO_PANIC: argv0=5000 nenv=40 envlen=6000 -- bcopy+underflow harmless
EXIT=0

Guest status after all runs: up
Panic in boot.log: NONE
dmesg corruption/slab warnings: NONE