BUILD_OK
DF-1040 CIS longlink/MFC target validation harness
PCCARD_CIS_SIZE = 4096 bytes (mapped window at pccard_cis.c:130-131)
pccard_cis_read_1 byte offset = mult * ptr  (pccardvar.h:255-256)
chain-transition deref at pccard_cis.c:413 has NO bounds check
case                                                mult     byte_off   expect   is_oob  fix_rej
----                                                ----     --------   ------   ------  -------
PoC longlink_A 0xFFFFFFFF mult=2 (attr mem)            2   8589934590      OOB      OOB      yes
longlink_C 0xFFFFFFFF mult=1 (common mem)              1   4294967295      OOB      OOB      yes
mfc entry 0xDEADBEEF mult=2                            2   7471857118      OOB      OOB      yes
mfc entry 0x80000000 mult=1                            1   2147483648      OOB      OOB      yes
boundary ptr=2044 mult=2 (needs 5 bytes)               2         4088      OOB      OOB      yes
valid   ptr=100  mult=2                                2          200       in       in       no
valid   ptr=2043 mult=2 (last in-window)               2         4086       in       in       no
valid   ptr=4091 mult=1 (last in-window)               1         4091       in       in       no
valid   ptr=0    mult=2                                2            0       in       in       no

Proof of primitive (PoC case):
  longlink_addr (card-supplied, 32-bit) = 0xFFFFFFFF
  tuple.mult (pccard_cis.c:393, attr mem) = 2
  tuple.ptr  (pccard_cis.c:394)           = 0xFFFFFFFF
  bus_space_read_1 byte offset (line 413) = 0x1FFFFFFFE
  mapped window size                      = 4096
  offset exceeds window by                = 8589930494 bytes
  => on real PCMCIA hardware this is a wild bus_space_read_1
     past the mapped resource => kernel page-fault panic.
  fix.diff rejects this target: YES (continue, no deref)

PASS: all cases agree — bug confirmed at logic level, fix is correct