DF-1041 harness: CISTPL_CFTABLE_ENTRY parser replication
image=cis_image.bin size=65536 bytes (kernel PCCARD_CIS_SIZE=4096)
first tuple @ attr-off 0 : code=0x1B length=8

=== UNPATCHED (master pccard_cis.c) ===
declared tuple->length   = 8 bytes
pccard_tuple_read_1 calls= 50001 (harness cap=50000)
final idx reached        = 50001 bytes
overshoot past length    = 49993 bytes (idx grew 6250x past declared length)
kernel byte offset       = mult*(ptr+2+idx) = 2*(0+2+50001) = 100006
faulted past img_len?    = YES
  -> first OOB read at idx=32766, byte_off=65536 (>= img_len=65536)
VERDICT: UNPATCHED parser runs the power do-while (pccard_cis.c:995-1003)
         and/or misc while (pccard_cis.c:1243-1246) without ANY
         idx<length guard. With this CIS image idx runs 50001 bytes
         past the 8-byte declared body before the harness cap (50000)
         or the image end (=> kernel page-fault panic on real HW).

=== PATCHED (fix.diff: idx>=length -> abort_cfe) ===
final idx reached        = 8 bytes (capped at length=8)
pccard_tuple_read_1 calls= 8
overshoot past length    = 0 bytes
faulted?                 = no
VERDICT: PATCHED parser aborts via abort_cfe at pccard_cis.c:1251
         the moment idx reaches tuple->length — no unbounded read.

SUMMARY: unpatched idx=50001 (>49993 past length) vs patched idx=8 (==length).