=== BASELINE -O2 (default kernel codegen) ===
DF-0596: ng_pptpgre xmitWin TOCTOU -> timeSent[] OOB write harness
================================================================

Struct layout:
  PPTP_XMIT_WIN = 16, sizeof(ackp) = 168
  &timeSent[16] = offset 200, &recvSeq = offset 200 -> OVERLAP (OOB target confirmed)

[threads=2] 200000 rounds: xmitWin>16 in 0 rounds, max_xw=16
[threads=4] 200000 rounds: xmitWin>16 in 0 rounds, max_xw=16
[threads=8] 200000 rounds: xmitWin>16 in 0 rounds, max_xw=16

=== RESULTS ===
Total over-16 rounds: 0, max_xw=16 (PPTP_XMIT_WIN=16)
Race not won in userspace (xmitWin stayed <= 16). Codegen prevents
exceeding the bound. Missing serialization still causes data races.
=== BASELINE -O0 (proves TOCTOU) ===
DF-0596: ng_pptpgre xmitWin TOCTOU -> timeSent[] OOB write harness
================================================================

Struct layout:
  PPTP_XMIT_WIN = 16, sizeof(ackp) = 168
  &timeSent[16] = offset 200, &recvSeq = offset 200 -> OVERLAP (OOB target confirmed)

[threads=2] 200000 rounds: xmitWin>16 in 31 rounds, max_xw=17
[threads=4] 200000 rounds: xmitWin>16 in 70 rounds, max_xw=17
[threads=8] 200000 rounds: xmitWin>16 in 3 rounds, max_xw=17

=== RESULTS ===
Total over-16 rounds: 104, max_xw=17 (PPTP_XMIT_WIN=16)
*** CONFIRMED: xmitWin can exceed PPTP_XMIT_WIN -> timeSent[] OOB ***
=== FIXED -O0 (proves fix) ===
DF-0596 FIXED: xmitWin growth with clamp + OOB prevention
=========================================================

Layout: &timeSent[16]=offset 200, &recvSeq=offset 200 -> OVERLAP (OOB target)

[threads=2] 10000 rounds: xmitWin>16 in 0 rounds, max_xw=16
[threads=4] 10000 rounds: xmitWin>16 in 0 rounds, max_xw=16
[threads=8] 10000 rounds: xmitWin>16 in 0 rounds, max_xw=16

=== FIXED RESULTS ===
Total over-16: 0, max_xw=16 (PPTP_XMIT_WIN=16)
*** FIX WORKS: xmitWin clamped to PPTP_XMIT_WIN, no OOB possible ***