=== BUGGY walk (kernel behaviour on default GENERIC #0) ===
mode=clean          apply_fix=0    -> rc=0  clean exit (terminator found within buffer)
mode=oob_short      apply_fix=0    -> rc=0  clean exit (terminator found within buffer)
mode=oob_fill       apply_fix=0    -> rc=2  SIGSEGV -> OOB read past run-list buffer (into adjacent slab in kernel)
mode=oob_infinite   apply_fix=0    -> rc=2  SIGSEGV -> OOB read past run-list buffer (into adjacent slab in kernel)

=== FIXED walk (proposed fix: bound by runlen) ===
mode=clean          apply_fix=1    -> rc=0  clean exit (terminator found within buffer)
mode=oob_short      apply_fix=1    -> rc=0  clean exit (terminator found within buffer)
mode=oob_fill       apply_fix=1    -> rc=-1  FIX REJECTED input (EINVAL — bounded walk caught overflow)
mode=oob_infinite   apply_fix=1    -> rc=0  clean exit (terminator found within buffer)

=== exit codes summary ===
0=clean, 1=infinite-loop-cap, 2=SIGSEGV(OOB), -1=fix-rejected(EINVAL)