== STOCK trigger (in=out=0x80000000) ==
dfh: DF2248: TRIGGER in=out=0x80000000 (bit 31 set -> int r negative -> while(r--) runaway)


Fatal trap 12: page fault while in kernel mode
cpuid = 4; lapic id = 4
fault virtual address	= 0xfffff801167bf000
fault code		= supervisor write data, page not present
instruction pointer	= 0x8:0xffffffff809da513
stack pointer	        = 0x10:0xfffff801167bc6c0
frame pointer	        = 0x10:0xfffff801167bc6d8
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= interrupt enabled, resume, IOPL = 0
current process		= 823
current thread          = pri 6
kernel: type 12 trap, code=2

CPU4 stopping CPUs: 0x0000002f
 stopped
Stopped at      iconv_xlat_conv+0x63:   movb    %r9b,(%rbx,%rax,1)

== STOCK truncation probe (in=out=0x100000000) ==
dfh: DF2247: mode 2 conv ret=0 consumed=256 produced=256

== controls ==
dfh: DF2248: mode 0 conv ret=0 ilen_left=0 olen_left=0
dfh: DF2248: control output:
dfh: DF2248 control out [16 bytes]: aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa aa
dfh: DF2248: TRUNCATION PROBE in=out=0x100000000 (low 32 bits = 0)
dfh: DF2248: mode 2 conv ret=0 ilen_left=4294967296 olen_left=4294967296
dfh: DF2248: mode 2 SURVIVED (mode 1 unexpected on stock; mode 2 surviving with consumed=0 IS the truncation proof)

== FIXED kernel, same 0x80000000 trigger ==
Fatal trap 12 supervisor WRITE at iconv_xlat_conv (see run_fixed_trigger_boot.txt)
-- caller-supplied counters remain trusted by design (xlat16 parity); the
   int sign/truncation defect itself is eliminated (controls identical,
   probe semantics changed, see VERDICT.md)