=== DF-0861 deterministic OOB-WRITE proof ===
struct sizes: cpdblk=136 cpiblk=16 cpisec=512 (CPIS_MAX=31)

--- BUG MODE (unpatched hpfs_cpinit) ---
  sp_cpinum=1 -> cpicnt=1 -> kmalloc(hpm_cpdblk)=136 bytes
  cpisec.s_cpicnt=31 -> inner for() runs 31 times
  result: in-bounds writes=1  OOB writes=30  OOB bytes=4080  poison=no
  DF_0861_BUG_OOB_WRITE_BYTES=4080
  DF_0861_BUG_CONFIRMED=1

  first-OOB cpdblk b_upcase[0..1] = 0x41 0x42 (marker 0x41 0x42) -> ATTACKER-CONTROLLED
--- FIXED MODE (inner loop bounded by allocated slots) ---
  result: in-bounds writes=1  OOB writes=0  OOB bytes=0  poison=no
  DF_0861_FIX_OOB_WRITE_BYTES=0
  DF_0861_FIX_REJECTS_OVERFLOW=1

=== SUMMARY ===
DF_0861_BUG_CONFIRMED=1
DF_0861_BUG_OOB_WRITE_BYTES=4080
DF_0861_BUG_OOB_ATTACKER_CONTROLLED=1
DF_0861_FIX_REJECTS_OVERFLOW=1
RUN_EXIT=0