=== RUN DF-1857 2026-07-20T18:44:52Z ===
DF-1857: bmp_DecodeRLE8 walk (splash_bmp.c:307-410)
  data_size=64 bytes, no end-of-bitmap escape
  final index offset = 4160 bytes past data start
  OOB read = 4096 bytes past the splash image into kernel memory
  In the kernel this either paints leaked kmem to the framebuffer (/dev/fb0 leak) or hits an unmapped page and panics during boot.
  bmp_Start (splash_bmp.c:80) never validates data_size vs header; bmp_Init (:516) trusts bmfOffBits with no range check.
[exit=0]