== DF-2291 run: Thu Oct 15 22:19:06 UTC 2026
== guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
---- [BASELINE-unmodified-production-fwcrom.c] mode=df2291_guard
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=df2291_guard result=OOB_FAULT_CONFIRMED
  crom_parse_text() (textleaf->text[i] read) dereferenced memory at 0x800476000
  buffer=[0x800475c00,0x800476000) size=1024 -> fault address is 0 bytes past the buffer end
     exit=0
---- [BASELINE-unmodified-production-fwcrom.c] mode=df2291_canary
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page CANARY (readable, marked)
RIG mode=df2291_canary result=OOB_LEAK_CONFIRMED
  crom_parse_text output (the buffer that becomes sdev->vendor/product, sbp.c:606,621):
    ab0de000 ab0de001 ab0de002 c0ffee00 c0ffee01 c0ffee02 c0ffee03 c0ffee04
  words 3..7 = canary 0xC0FFEE00..04 read from bytes 1024..1043, PAST the 1024-byte buffer
  (words 0..2 = in-buffer markers 0xAB0DE00x at 1012..1023)
     exit=0
---- [BASELINE-unmodified-production-fwcrom.c] mode=control
  rom object=[0x800475c00,0x800476000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=control result=PARSED_INBOUNDS
  in-bounds text leaf parsed: out words 54524300 54524301 54524302 54524303, no fault (guard page untouched)
     exit=0
---- [PATCHED-fix.diff-applied] mode=df2291_guard
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=df2291_guard result=NULLSTR_NO_FAULT (leaf rejected by bounds check: out="(null)")
     exit=0
---- [PATCHED-fix.diff-applied] mode=df2291_canary
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page CANARY (readable, marked)
RIG mode=df2291_canary result=NULLSTR_NO_FAULT (leaf rejected by bounds check: out="(null)")
     exit=0
---- [PATCHED-fix.diff-applied] mode=control
  rom object=[0x800476c00,0x800477000) 1024 bytes, next page GUARD (PROT_NONE)
RIG mode=control result=PARSED_INBOUNDS
  in-bounds text leaf parsed: out words 54524300 54524301 54524302 54524303, no fault (guard page untouched)
     exit=0
== expected:
   BASELINE df2291_guard  : OOB_FAULT_CONFIRMED (SIGSEGV @ buffer_end+0)
   BASELINE df2291_canary : OOB_LEAK_CONFIRMED (canary words 0xC0FFEE00..04
                             from bytes 1024..1043 land in the string buffer)
   BASELINE control       : PARSED_INBOUNDS (rig sanity)
   PATCHED  df2291_guard  : NULLSTR_NO_FAULT (leaf rejected: *4 bound)
   PATCHED  df2291_canary : NULLSTR_NO_FAULT
   PATCHED  control       : PARSED_INBOUNDS (no regression)