== DF-2290 run: Thu Oct 15 22:19:06 UTC 2026
== guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
---- [BASELINE-unmodified-production-fwcrom.c] mode=df2290_guard
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=df2290_guard result=OOB_FAULT_CONFIRMED
  crom_search_key() (root entry deref) dereferenced memory at 0x800476003
  buffer=[0x800475c00,0x800476000) size=1024 -> fault address is 3 bytes past the buffer end
     exit=0
---- [BASELINE-unmodified-production-fwcrom.c] mode=df2290_canary
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page CANARY (readable, marked)
RIG mode=df2290_canary result=OOB_LEAK_CONFIRMED
  crom_search_key(0x03) returned reg=0x80047601c (buffer+1052; 28 bytes PAST the 1024-byte buffer)
  reg->key=0x03 reg->val=0xc0ffee  <- key/value read from memory OUTSIDE the buffer
  canary 0x00C0FFEE (planted only past the buffer) confirmed in reg->val
     exit=0
---- [BASELINE-unmodified-production-fwcrom.c] mode=control
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=control result=PARSED_INBOUNDS
  in-bounds text leaf parsed: out words 54524300 54524301 54524302 54524303, no fault (guard page untouched)
     exit=0
---- [PATCHED-fix.diff-applied] mode=df2290_guard
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page GUARD (PROT_NONE)
crom_init_context: info_len 254 out of range
RIG mode=df2290_guard result=REJECTED_NO_FAULT
  crom_init_context rejected the ROM (depth=-1), no OOB access
     exit=0
---- [PATCHED-fix.diff-applied] mode=df2290_canary
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page CANARY (readable, marked)
crom_init_context: info_len 254 out of range
RIG mode=df2290_canary result=REJECTED_NO_FAULT
  crom_init_context rejected the ROM (depth=-1), no OOB access
     exit=0
---- [PATCHED-fix.diff-applied] mode=control
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=control result=PARSED_INBOUNDS
  in-bounds text leaf parsed: out words 54524300 54524301 54524302 54524303, no fault (guard page untouched)
     exit=0
== expected:
   BASELINE df2290_guard  : OOB_FAULT_CONFIRMED (SIGSEGV past buffer end)
   BASELINE df2290_canary : OOB_LEAK_CONFIRMED (reg->val = canary past buffer)
   BASELINE control       : PARSED_INBOUNDS (rig sanity)
   PATCHED  df2290_guard  : REJECTED_NO_FAULT (info_len>4 rejected)
   PATCHED  df2290_canary : REJECTED_NO_FAULT
   PATCHED  control       : PARSED_INBOUNDS (no regression)