=== BUILD OK ===
=== DF-1124 iwn5000_rx_calib_results primitive demo ===

[case 1] firmware reports masked len = 0 (underflow)
masked desc->len & 0x3fff = 0
len = masked - 4           = -4
  -> signed UNDERFLOW. kmalloc((size_t)-4) = kmalloc(18446744073709551612)
  -> kmalloc fails (ENOMEM), no further damage on this path.

[case 2] firmware reports masked len = 3 (underflow)
masked desc->len & 0x3fff = 3
len = masked - 4           = -1
  -> signed UNDERFLOW. kmalloc((size_t)-1) = kmalloc(18446744073709551615)
  -> kmalloc fails (ENOMEM), no further damage on this path.

[case 3] firmware reports masked len = 16380 (OOB read)
masked desc->len & 0x3fff = 16380
len = masked - 4           = 16376
  memcpy(calibcmd.buf, calib, 16376) from offset 8 in 4096-byte mbuf
  -> OOB READ of 12288 bytes past mbuf cluster boundary (info leak / panic source)

[case 4] firmware reports masked len = 200 (benign)
masked desc->len & 0x3fff = 200
len = masked - 4           = 196
  memcpy(calibcmd.buf, calib, 196) from offset 8 in 4096-byte mbuf
  -> within mbuf, benign.

Conclusion: no clamp on len -> both underflow and over-read are
reachable from a buggy/compromised firmware or DMA injection.
RUN_EXIT=0