RUN_START
Header bounds check (evergreen_cs.c:2806) PASSED: idx=3 < length_dw=4
idx+8 = 11, length_dw = 4
ib[idx+8] read = 0x00000000  (OUT OF BOUNDS: idx+8=11 >= length_dw=4)
ib[idx+8] written back = 0x11111111  (heap word corrupted)

PRIMITIVE CONFIRMED: idx+8 (11) >= length_dw (4); OOB read+write past IB.
Header-only bounds check at evergreen_cs.c:2806 is insufficient. Bug is REAL.
EXIT=0