PNPH canrd[0]: c1=0xfffff801175a2200 c2=0xfffff801175a2400 res=0xfffff801175a23fc res+13=0xfffff801175a2409 (c2+9) PNPH canrd[0]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak) PNPH canrd f[0]= 0x1 expect= 0x1 PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b PNPH canrd f[2]=0x528c8486 expect=0x528c8486 PNPH canrd f[3]=0x21595241 expect=0x21595241 PNPH canrd f[4]=0x4e414336 expect=0x4e414336 PNPH canrd[1]: c1=0xfffff801175a5200 c2=0xfffff801175a5400 res=0xfffff801175a53fc res+13=0xfffff801175a5409 (c2+9) PNPH canrd[1]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak) PNPH canrd f[0]= 0x1 expect= 0x1 PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b PNPH canrd f[2]=0x528c8486 expect=0x528c8486 PNPH canrd f[3]=0x21595241 expect=0x21595241 PNPH canrd f[4]=0x4e414336 expect=0x4e414336 PNPH canrd[2]: c1=0xfffff801175a8200 c2=0xfffff801175a8400 res=0xfffff801175a83fc res+13=0xfffff801175a8409 (c2+9) PNPH canrd[2]: ir_size=0x21595241 == I32(c2+9)=0x21595241 ir_align=0x4e414336 == I32(c2+5)=0x4e414336 -> read 13 bytes past the 512B chunk (canary text leak) PNPH canrd f[0]= 0x1 expect= 0x1 PNPH canrd f[1]=0x445d5c5b expect=0x445d5c5b PNPH canrd f[2]=0x528c8486 expect=0x528c8486 PNPH canrd f[3]=0x21595241 expect=0x21595241 PNPH canrd f[4]=0x4e414336 expect=0x4e414336 PNPH e2e3: groom=0xfffff8008db35800 stream=0xfffff8008db35800 same=1 (uninitialized heap residue visible past the descriptor) PNPH e2e3: residue bytes st[3..19]: ff ff ff ff ff 45 53 49 44 55 45 2d 48 45 41 50 44 <.....ESIDUE-HEAPD> PNPH e2e3: stored config: PNPH e2e3: nmem=1 nport=0 nirq=0 ndrq=0 PNPH e2e3: mem[0] start=0xffffffff end=0x88999489 size=0x44504145 align=0x482d4555 PNPH e2e3: ir_size=0x44504145 == I32(st+16)=0x44504145 -> kernel heap residue flowed into the device resource config (devinfo/bootverbose visible)