=== DF-2276 decisive BASELINE (vulnerable) runs (from rig/run_baseline_outer.log) ===
=== DF-2276a: neg {0,-4096} FULL path (negative b_bcount -> real dastrategy/dastart) ===
debug.dfda.zero: 0 -> 0
mode=neg       start=0 (0x0) len=-4096 (0xfffffffffffff000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=0 errno=0 (success) in 0.000 sec
debug.dfda.stats: strat_count=1 forced=0 trim_ccbs=1 trim_zero_ranges=0 trim_ranges_total=64 sched_calls=3 rel_count=4 runcap=1 bcount_nonzero=1 bcount_negative=1 offset_nonzero=0
last_trim: cdb=00 00 00 00 00 00 dxfer=1536 ranges=64 bio_bcount=-4096 data16=000000000000ffffffff00000000ffff
cap[0]: bcmd=3 bcount=-4096 (0xfffff000) offset=0

=== DF-2276a2: neg {0,-4096} CAPTURE mode (what the dispatch itself sends) ===
debug.dfda.mode: 1 -> 0
debug.dfda.zero: 0 -> 0
mode=neg       start=0 (0x0) len=-4096 (0xfffffffffffff000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=0 errno=0 (success) in 0.000 sec
debug.dfda.stats: strat_count=1 forced=0 trim_ccbs=0 trim_zero_ranges=0 trim_ranges_total=0 sched_calls=0 rel_count=1 runcap=1 bcount_nonzero=1 bcount_negative=1 offset_nonzero=0
last_trim: cdb=00 00 00 00 00 00 dxfer=0 ranges=-1 bio_bcount=0 data16=000000000000ffffffff00000000ffff
cap[0]: bcmd=3 bcount=-4096 (0xfffff000) offset=0

=== DF-2276b: llmin {0,LLONG_MIN} FULL path, watchdog 200000 ===
debug.dfda.mode: 0 -> 1
debug.dfda.watchdog: 0 -> 200000
debug.dfda.zero: 0 -> 0
mode=llmin     start=0 (0x0) len=-9223372036854775808 (0x8000000000000000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=-1 errno=5 (Input/output error) in 0.092 sec
debug.dfda.stats: strat_count=200001 forced=1 trim_ccbs=200000 trim_zero_ranges=200000 trim_ranges_total=0 sched_calls=600000 rel_count=600001 runcap=1 bcount_nonzero=0 bcount_negative=0 offset_nonzero=0
last_trim: cdb=00 00 00 00 00 00 dxfer=0 ranges=0 bio_bcount=0 data16=00000000000000000000000000000000
cap[0]: bcmd=3 bcount=0 (0x0) offset=0
cap[1]: bcmd=3 bcount=0 (0x0) offset=0
cap[2]: bcmd=3 bcount=0 (0x0) offset=0
cap[3]: bcmd=3 bcount=0 (0x0) offset=0
cap[4]: bcmd=3 bcount=0 (0x0) offset=0
cap[5]: bcmd=3 bcount=0 (0x0) offset=0
cap[6]: bcmd=3 bcount=0 (0x0) offset=0
cap[7]: bcmd=3 bcount=0 (0x0) offset=0

vfs.getnewbufcalls: 201131
=== DF-2276b2: llmin CAPTURE mode, watchdog 1000000 (rate + stability) ===
debug.dfda.mode: 1 -> 0
debug.dfda.watchdog: 200000 -> 1000000
debug.dfda.zero: 0 -> 0
mode=llmin     start=0 (0x0) len=-9223372036854775808 (0x8000000000000000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=-1 errno=5 (Input/output error) in 0.105 sec
debug.dfda.stats: strat_count=1000001 forced=1 trim_ccbs=0 trim_zero_ranges=0 trim_ranges_total=0 sched_calls=0 rel_count=1 runcap=1 bcount_nonzero=0 bcount_negative=0 offset_nonzero=0
last_trim: cdb=00 00 00 00 00 00 dxfer=0 ranges=-1 bio_bcount=0 data16=00000000000000000000000000000000
cap[0]: bcmd=3 bcount=0 (0x0) offset=0
cap[1]: bcmd=3 bcount=0 (0x0) offset=0
cap[2]: bcmd=3 bcount=0 (0x0) offset=0
cap[3]: bcmd=3 bcount=0 (0x0) offset=0
cap[4]: bcmd=3 bcount=0 (0x0) offset=0
cap[5]: bcmd=3 bcount=0 (0x0) offset=0
cap[6]: bcmd=3 bcount=0 (0x0) offset=0
cap[7]: bcmd=3 bcount=0 (0x0) offset=0

debug.dfda.watchdog: 1000000 -> 0
=== dmesg capture ===

=== DF-2276 FIXED kernel A/B (fix.diff applied) ===
mode=neg       start=0 (0x0) len=-4096 (0xfffffffffffff000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=-1 errno=22 (Invalid argument) in 0.000 sec
mode=llmin     start=0 (0x0) len=-9223372036854775808 (0x8000000000000000) DAIOCTRIM=0x80104380 -> ioctl...
ioctl returned r=-1 errno=22 (Invalid argument) in 0.000 sec

buffer-allocation evidence: vfs.getnewbufcalls before=1125 after=201131 (delta 200006 = one getnewbuf per loop iteration, 200001 bios + opens)