[DF-1286] SIBA_SPROM_BASE=0x1000, sizeof(word)=2
[DF-1286] SPROM buffer = 220 words; TXPID reads use SIBA_SHIFTOUT (in[SIBA_OFFSET(offset)])

=== AS-SHIPPED (buggy) TXPID constants 0x0062..0x0070 ===
  constant 0x0062 -> SIBA_OFFSET = -1999  => NEGATIVE: in[-1999] reads -3998 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x0064 -> SIBA_OFFSET = -1998  => NEGATIVE: in[-1998] reads -3996 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x0066 -> SIBA_OFFSET = -1997  => NEGATIVE: in[-1997] reads -3994 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x0068 -> SIBA_OFFSET = -1996  => NEGATIVE: in[-1996] reads -3992 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x006a -> SIBA_OFFSET = -1995  => NEGATIVE: in[-1995] reads -3990 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x006c -> SIBA_OFFSET = -1994  => NEGATIVE: in[-1994] reads -3988 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x006e -> SIBA_OFFSET = -1993  => NEGATIVE: in[-1993] reads -3986 bytes BEFORE the SPROM buffer (heap leak)
  constant 0x0070 -> SIBA_OFFSET = -1992  => NEGATIVE: in[-1992] reads -3984 bytes BEFORE the SPROM buffer (heap leak)

[DF-1286] Worst case: in[-1999] reads bytes [-3998..-3997] relative to SPROM base (i.e. -3998 bytes before the allocation).
[DF-1286] Simulated leak: buggy txpid2g[0] = 0xbe65 (heap residue before SPROM buf), NOT the real SPROM TXPID value.

=== FIXED constants 0x1062..0x1070 (absolute, like all siblings) ===
  SIBA_OFFSET(0x1062) = 49  -> in[49] reads the REAL SPROM word
  fixed txpid2g[0]  = 0x1111 (matches the SPROM image)
  fixed txpid5gh[3] = 0x8888

[DF-1286] RESULT: BUG CONFIRMED -- 3998 bytes of kernel heap read before the SPROM buffer per SPROM rev4/5/8 parse (16 reads total = 32 bytes),
          surfacing via SIBA_SPROMVAR_TXPID_* sysctl spromvars (KASLR/heap-info leak).
RUN_EXIT=0