== DF-2395 rig attempts (ACHARNESS #3, aib_shim verbatim interposition) ==
attempt 1 (mode 1 = empty SIF + canary padding):
  aibsim mode=1; op=attach -> harness guest wedged before any
  "VSIF[0]: invalid type" line appeared on console or in aibsim log
attempt 2 (mode 2 = empty SIF + page edge):
  op=page_alloc (kmem_alloc + pmap_kextract check) -> then attach ->
  guest wedged again, no trap, no log
separate: DF-2385 page-edge probe showed the kernel_map is densely mapped
(no unmapped neighbor for kmem_alloc pages)
VERDICT: rig could not complete the attach choreography; the o[0] OOB read
remains source-certain (atk0110.c:169-171); DF-2006 duplicate