=== fixed kernel (FWH #8, fix.diff clamp) — malicious len=1500 ===
DF-2295: read() returned 1024 (errno=0)
DF-2295: returned packet header = 05dc01a0 (len=1500 tcode=a sy/chtag=a0)
DF-2295: copied 1024 bytes; slot capacity 512 -> reported as 512 beyond first slot
  (two SEPARATE clamped per-slot copies of 512 bytes each; no single copy
   crosses a slot boundary; slot 1 canary read as a "packet" is an artifact
   of the injector pre-filling every slot)
=== fixed kernel — legit len=508 ===
DF-2295: read() returned 512 (errno=0)
DF-2295: copied 512 bytes; 0 bytes beyond the packet slot
hexdump diff vs baseline (leak_legit_508.txt vs leak_fixed_508.txt): EMPTY
BIT_IDENTICAL_508