=== DF-2314 FIX VALIDATION RUN (fixed kernel: both pnp.c fixes applied
    DragonFly 6.5-DEVELOPMENT #6: Sun Oct 18 16:13:52 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PNPH)
=== fix applied in guest /usr/src (verified) ===
406:				while (large_len > 0 && buf[large_len-1] == ' ')
2 quirk guards: `if (qp->arg1 != 0 && config->ic_nport < ISA_NPORT) {` (and arg2)

--- scenario 3: sanity - must still work (no regression) ---
== scenario 3 rc=0
  desc len=14 child=(null)
  desc ascii: <LEGIT-DEV-NAME>
PNPH 2314 sane: desc=<LEGIT-DEV-NAME> len=14                      [SAME AS BASELINE: OK]

--- scenario 10: smart walk - the OOB read/write + uninit desc must be GONE ---
== scenario 10 rc=0
  desc len=0 child=(null)
PNPH smart: buf located at pad+8044 kva 0xfffff80117b03494 (pad [0xfffff80117b01528,0xfffff80117b03528))
PNPH smart: chosen phase=0
PNPH smart walk: desc len=0 ascii=<>                              [BASELINE: leak / walk]
PNPH smart: no NUL-write signature found                          [BASELINE: 1 signature at pad+8032 = buf[-12]]
    -> with the `large_len > 0 &&` guard the trim loop never reads buf[-1]:
       no backwards walk, no NUL write below buf, buf[0]='\0', desc="".

--- probe 11: the leak path (ANSI-first + LD) must be GONE ---
PNPH probe11 (ANSI-first): child desc=<> len=0                    [BASELINE: 18-byte stack-residue leak]
    -> THE LEAK IS ELIMINATED: the guarded trim stops at buf[0], desc is an
       empty string, no uninitialized stack content reaches device_set_desc_copy.

VERDICT: baseline symptom (OOB stack read below buf + NUL write at buf[-12] +
uninitialized-stack -> device description leak) fully eliminated by the
one-line `large_len > 0 &&` guard; positive path (normal ANSI strings)
unaffected.