=== BASELINE: unpatched kernel 6.5-DEVELOPMENT #0 (Thu Jul  2 06:02:54 UTC 2026) ===
SHA256 (/boot/kernel/kernel) = 5dc83dac19ad09effd6241c33e0c0669d41b6497ee92d87d3a2e45f287bc22ad

=== In-kernel module (buggy > loop) on #0 ===
  fentry l_ea=0 l_ad=8 (1 short_ad), offset=2048
  loop rc=0 sector=0xcafebabe max_size=0xdeadbeef oob_read=1
DF-0832: OOB READ DETECTED at ad_offset==l_ad==8:
  loop dereferenced &fentry->data[l_ea+l_ad] = ONE PAST the
  allocation-descriptor area.  On a real fentry this is an 8-byte
  (short_ad) / 16-byte (long_ad) heap OOB read.
  CONFIRMED: returned values are the guard sentinel (0xcafebabe / 0xdeadbeef).

=== Real UDF image mount + read at offset 2048 on #0 ===
  dd: /tmp/mnt/target: Invalid argument
  dmesg: File offset out of bounds
  (The OOB read happened at bmap iter 2 — ad_offset=8, l_ad=8, 8>8 is FALSE.
   The OOB bytes were zero [slab padding], so icblen=0, causing iter 3 where
   ad_offset=16 > l_ad=8 is TRUE -> kprintf + EINVAL. The OOB read at iter 2
   is proven by source analysis + harness + in-kernel module.)

=== Userspace harness on #0 ===
  OOB read detected: YES
  CONFIRMED: returned sector/max_size are the guard sentinel
  (0xcafebabe / 0xdeadbeef)
  RUN_EXIT=1