== fix-validation run: kernel #9 (fix2255+fix2256), serial console ==
DragonFly 6.5-DEVELOPMENT #9: Sat Oct 17 17:54:41 UTC 2026
DFH: arrfail: read_array(addr=2, many=16) on 4KB dev -> retval=0 (AH_TRUE=1); device-stub reads=3 (the 13 negative-address reads were rejected by the address<0 check inside the verbatim read_eeprom before ever reaching the device)
DFH: arrfail: buf after call: 11 22 33 cc cc cc cc cc cc cc cc cc cc cc cc cc
DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel; retval AH_TRUE=0: FIX EFFECTIVE: failure propagated (AH_FALSE), slots never written
DFH: command 'arrfail' done
DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=1
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 0 times (MSTATE cap 100): failure propagated after 1 read(s) -- FIX EFFECTIVE, no garbage-driven parse
DFH: uninit: fail-all frame still holds the groom stream (offset -1, siglen 0) -- failed reads never wrote it:
DFH: uninit word[0] SIGNATURE NOT FOUND in window
DFH: command 'uninit' done
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2056 fails=0
DFH: otp2k: word[0] located at offset -1 (siglen 0)
DFH: otp2k word[0] SIGNATURE NOT FOUND in window
DFH: otp2k: word[2048..2052] keeps pre-call content in 0/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256
DFH: command 'otp2k' done
DFH: chk: len=1024 code=_compress_block ret=-1 reads=1044 fails=0
DFH: chk: restored eeprom image starts with:DF2255-PWNED-OK!
DFH: chk: attacker-computed 16-bit additive checksum passed the gate, dispatch reached _compress_block and applied the payload to the in-RAM eeprom image: CONFIRMED (16/16 marker bytes)
DFH: command 'chk' done
DFH: ovf len=2043: verbatim ret=-1 byte-reads=3141 fails=0 (cptr=4095, lowest byte address 2047 >= 0: every read succeeds on a 4KB device)
DFH: ovf: locate failed, using last-known word[0] offset 6080
DFH: ovf-win_a +17b0: 00 00 00 00 a5 a5 a5 00 00 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win_a +17c0: 00 00 00 00 00 00 9b 98 99 9e 9f 9c 9d 92 93 90
DFH: ovf-win_a +17d0: 91 96 97 94 95 8a 8b 88 89 8e 8f 8c 8d 82 83 80
DFH: ovf-win_a +17e0: 81 86 87 84 85 ba bb b8 b9 be bf bc bd b2 b3 b0
DFH: ovf word[0] at window+6080 word[2040..2063]: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 60 2c 7a 81 ff ff ff ff
DFH: ovf len=2043 -> read_array of 2049 bytes into word[2048]: a5 (attacker eeprom values e0) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
DFH: ovf len=2044: verbatim ret=-1 byte-reads=3141 fails=0 (cptr=4095, lowest byte address 2046 >= 0: every read succeeds on a 4KB device)
DFH: ovf: locate failed, using last-known word[0] offset 6080
DFH: ovf-win_a +17b0: 00 00 00 00 a5 a5 a5 00 00 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win_a +17c0: 00 00 00 00 00 00 9b 98 99 9e 9f 9c 9d 92 93 90
DFH: ovf-win_a +17d0: 91 96 97 94 95 8a 8b 88 89 8e 8f 8c 8d 82 83 80
DFH: ovf-win_a +17e0: 81 86 87 84 85 ba bb b8 b9 be bf bc bd b2 b3 b0
DFH: ovf word[0] at window+6080 word[2040..2063]: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 60 2c 7a 81 ff ff ff ff
DFH: ovf len=2044 -> read_array of 2050 bytes into word[2048]: a5 a5 (attacker eeprom values e0 e1) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
DFH: ovf len=2045: verbatim ret=-1 byte-reads=3141 fails=0 (cptr=4095, lowest byte address 2045 >= 0: every read succeeds on a 4KB device)
DFH: ovf: locate failed, using last-known word[0] offset 6080
DFH: ovf-win_a +17b0: 00 00 00 00 a5 a5 a5 00 00 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win_a +17c0: 00 00 00 00 00 00 9b 98 99 9e 9f 9c 9d 92 93 90
DFH: ovf-win_a +17d0: 91 96 97 94 95 8a 8b 88 89 8e 8f 8c 8d 82 83 80
DFH: ovf-win_a +17e0: 81 86 87 84 85 ba bb b8 b9 be bf bc bd b2 b3 b0
DFH: ovf word[0] at window+6080 word[2040..2063]: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 60 2c 7a 81 ff ff ff ff
DFH: ovf len=2045 -> read_array of 2051 bytes into word[2048]: a5 a5 a5 (attacker eeprom values e0 e1 e2) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
DFH: ovf len=2046: verbatim ret=-1 byte-reads=3141 fails=0 (cptr=4095, lowest byte address 2044 >= 0: every read succeeds on a 4KB device)
DFH: ovf: locate failed, using last-known word[0] offset 6080
DFH: ovf-win_a +17b0: 00 00 00 00 a5 a5 a5 00 00 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win_a +17c0: 00 00 00 00 00 00 9b 98 99 9e 9f 9c 9d 92 93 90
DFH: ovf-win_a +17d0: 91 96 97 94 95 8a 8b 88 89 8e 8f 8c 8d 82 83 80
DFH: ovf-win_a +17e0: 81 86 87 84 85 ba bb b8 b9 be bf bc bd b2 b3 b0
DFH: ovf word[0] at window+6080 word[2040..2063]: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 60 2c 7a 81 ff ff ff ff
DFH: ovf len=2046 -> read_array of 2052 bytes into word[2048]: a5 a5 a5 a5 (attacker eeprom values e0 e1 e2 e3) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
DFH: ovf len=2047: verbatim ret=-1 byte-reads=3141 fails=0 (cptr=4095, lowest byte address 2043 >= 0: every read succeeds on a 4KB device)
DFH: ovf: locate failed, using last-known word[0] offset 6080
DFH: ovf-win_a +17b0: 00 00 00 00 a5 a5 a5 00 00 a5 a5 a5 a5 a5 a5 a5
DFH: ovf-win_a +17c0: 00 00 00 00 00 00 9b 98 99 9e 9f 9c 9d 92 93 90
DFH: ovf-win_a +17d0: 91 96 97 94 95 8a 8b 88 89 8e 8f 8c 8d 82 83 80
DFH: ovf-win_a +17e0: 81 86 87 84 85 ba bb b8 b9 be bf bc bd b2 b3 b0
DFH: ovf word[0] at window+6080 word[2040..2063]: a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 a5 60 2c 7a 81 ff ff ff ff
DFH: ovf len=2047 -> read_array of 2053 bytes into word[2048]: a5 a5 a5 a5 a5 (attacker eeprom values e0 e1 e2 e3 e4) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
DFH: command 'ovfall' done
DFH: diff: two identical calls; only the eeprom bytes for word[2048..2052] differ (0xE0..E4 vs 0xD0..D4); ret1=-1 ret2=-1 off_a=6080 off_b=6080
DFH: diff: stack bytes that changed RELATIVE TO word[0] (range 2030..2063): +2057(2c->0c) (noise) (none)
DFH: diff: 0 stack byte(s) in the OOB slots word[2048..2052] track the eeprom content -- no eeprom-controlled writes past word[2047] (FIX EFFECTIVE)
DFH: command 'diff' done

== fix1 differential run: kernel #7/#8 (fix2255 ONLY - DF-2256 still live) ==
logs/run_fix1_fullbattery.log:DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel, yet the function returned AH_TRUE: *** DF-2256 CONFIRMED ***
logs/run_fix1_fullbattery.log:DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 0 times (MSTATE cap 100): MISMATCH (10 fails)
logs/run_fix1_fullbattery.log:DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel, yet the function returned AH_TRUE: *** DF-2256 CONFIRMED ***
logs/run_fix1_fullbattery.log:DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 0 times (MSTATE cap 100): MISMATCH (10 fails)
logs/run_fix1.log:DFH: ovf len=2043 -> read_array of 2049 bytes into word[2048]: a5 (attacker eeprom values e0) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
logs/run_fix1.log:DFH: ovf len=2044 -> read_array of 2050 bytes into word[2048]: a5 a5 (attacker eeprom values e0 e1) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
logs/run_fix1.log:DFH: ovf len=2045 -> read_array of 2051 bytes into word[2048]: a5 a5 a5 (attacker eeprom values e0 e1 e2) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
logs/run_fix1.log:DFH: ovf len=2046 -> read_array of 2052 bytes into word[2048]: a5 a5 a5 a5 (attacker eeprom values e0 e1 e2 e3) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)
logs/run_fix1.log:DFH: ovf len=2047 -> read_array of 2053 bytes into word[2048]: a5 a5 a5 a5 a5 (attacker eeprom values e0 e1 e2 e3 e4) no eeprom bytes landed past word[2047] (sentinel intact -- FIX EFFECTIVE)