DF-0785 fix-validation run — FIXED ntfs.ko on #0 GENERIC
=========================================================
Same chain binary + same crafted image (ir_size=704, va_datalen=744) that yields
uid=0 on the UNFIXED ntfs.  With the fixed ntfs.ko (kmalloc(max(blsize,rdsize)))
the allocation is kmalloc(max(704,744))=kmalloc(744) -> 768-byte buffer, copy of
744 bytes -> NO overflow, so no socket is ever corrupted -> no escalation.

Run (as maxx, 12 rounds ~24 lookups, below the separate churn-DoS threshold):
[chain] pid=2901 uid=1001 euid=1001
[chain] shellcode @ 0x13371000 (157 B); forged protosw @ 0x13372800; forged port @ 0x13373000 (mp_putport->shellcode)
[chain] sprayed 5000 sockets (zone-34 / struct socket)
[chain] punched holes; 4000 live sockets remain
[chain] round 0 uid=1001 euid=1001
[chain] did not acquire root in 12 rounds
CHAIN_EXIT=1
=> guest UP afterward (no panic, no fault).  No privilege change.

BEFORE / AFTER (same #0 GENERIC kernel, only the ntfs module differs):
  UNFIXED ntfs  : ./chain  -> *** ROOT ACQUIRED *** uid=0 (run.chain1.log, run.chain2.log)
  FIXED ntfs.ko : ./chain  -> did not acquire root, uid stays 1001, guest UP (this log)

=> fix_status = fixed : the overflow (and therefore the uid=0 escalation) is gone.