== DF-2256 decisive baseline evidence (serial console, baseline kernel #3/#5/#6) ==
DFH: arrfail: read_array(addr=2, many=16) on 4KB dev -> retval=1 (AH_TRUE=1); device-stub reads=3 (the 13 negative-address reads were rejected by the address<0 check inside the verbatim read_eeprom before ever reaching the device)
DFH: arrfail: buf after call: 11 22 33 cc cc cc cc cc cc cc cc cc cc cc cc cc
DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel, yet the function returned AH_TRUE: *** DF-2256 CONFIRMED ***
login: DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=4104
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 1 times (MSTATE cap 100): *** DF-2256 AMPLIFIER CONFIRMED: uninit stack drove many > MOUTPUT ***
DFH: uninit: fail-all call frame still holds the groom stream (offset -1) -- reads never wrote it:
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2052 fails=0
DFH: otp2k: word[2048..2052] keeps pre-call content in 0/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256
DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=4104
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 1 times (MSTATE cap 100): *** DF-2256 AMPLIFIER CONFIRMED: uninit stack drove many > MOUTPUT ***
DFH: uninit: fail-all frame still holds the groom stream (offset 6080, siglen 8) -- failed reads never wrote it:
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2052 fails=0
DFH: otp2k: word[2048..2052] keeps pre-call content in 5/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256

== after fix.diff (DF-2256 fix; kernel #9, fix2255 also applied) ==
DFH: arrfail: read_array(addr=2, many=16) on 4KB dev -> retval=0 (AH_TRUE=1); device-stub reads=3 (the 13 negative-address reads were rejected by the address<0 check inside the verbatim read_eeprom before ever reaching the device)
DFH: arrfail: buf after call: 11 22 33 cc cc cc cc cc cc cc cc cc cc cc cc cc
DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel; retval AH_TRUE=0: FIX EFFECTIVE: failure propagated (AH_FALSE), slots never written
DFH: command 'arrfail' done
DFH: uninit: groom call ret=-1; fail-all call ret=-1 reads=0 fails=1
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 0 times (MSTATE cap 100): failure propagated after 1 read(s) -- FIX EFFECTIVE, no garbage-driven parse
DFH: uninit: fail-all frame still holds the groom stream (offset -1, siglen 0) -- failed reads never wrote it:
DFH: otp2k: cptr=2047 len=2047 on 2KB dev -> ret=-1 reads=2056 fails=0
DFH: otp2k: word[0] located at offset -1 (siglen 0)
DFH: otp2k: word[2048..2052] keeps pre-call content in 0/5 slots -> NO OOB write on a 2KB device (the 5 reads at negative addresses were rejected); those UNINITIALIZED bytes are still consumed by the checksum loop and the mchecksum compare at word[4+len],word[5+len]: DF-2256
DFH: chk: len=1024 code=_compress_block ret=-1 reads=1044 fails=0
DFH: chk: restored eeprom image starts with:DF2255-PWNED-OK!
DFH: chk: attacker-computed 16-bit additive checksum passed the gate, dispatch reached _compress_block and applied the payload to the in-RAM eeprom image: CONFIRMED (16/16 marker bytes)

== differential: fix2255 ONLY (kernel #7) -- DF-2256 still live ==
DFH: arrfail: addresses 2,1,0 read fine (buf[0..2]); addresses -1..-13 failed and their 13/13 slots still hold the pre-call sentinel, yet the function returned AH_TRUE: *** DF-2256 CONFIRMED ***
DFH: uninit: header read failed, word[0..3] kept stale groom bytes, blank-check compared GARBAGE, unpack derived length=2047 from UNINITIALIZED stack, payload read_array of 2053 bytes into word[2048] (5 past the end), looped 0 times (MSTATE cap 100): MISMATCH (10 fails)