BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8840 Jul 20 09:05 harness
DF-1300 dc_add_all_planes_for_stream stack-overflow harness (dead API)
MAX_SURFACES=3  sizeof(plane_states)=24 (3 ptrs)
calling vulnerable_add_planes(plane_count=8) -- MAX_SURFACES=3
=> 5 OOB writes past plane_states[MAX_SURFACES-1] expected (each writes a pointer into the frame past plane_states[])
BEFORE: plane_count=0  saved_rbp_canary=0xdeadbeefcafebabe  saved_rip_canary=0x1122334455667788
AFTER:
  plane_states[0] = 0x7fffffdfd900  (in-bounds)
  plane_states[1] = 0x7fffffdfd904  (in-bounds)
  plane_states[2] = 0x7fffffdfd908  (in-bounds)
  plane_count (overwritten by [3]) = 12
  saved_rbp_canary = 0x00007fffffdfd910  *** CORRUPTED ***
  saved_rip_canary = 0x00007fffffdfd914  *** CORRUPTED ***
RESULT: stack buffer overflow CONFIRMED at dc_resource.c:1570-1571 (plane_count>MAX_SURFACES overwrites frame past plane_states[])
IN-KERNEL IMPACT: latent (dead API, 0 in-tree callers) — stack overflow / potential control-flow hijack if a future DC consumer wires it without clamping
RUN_EXIT=0
RUN_EXIT=0