=== patched dm_target_crypt module (M_ZERO at dm_target_crypt.c:489) ===
=== guest kernel still #0 unpatched; only the dm_target_crypt.ko module replaced ===

run #1:
[*] DF-2436 dm_target_crypt_destroy uninitialized-heap-use
[*] trigger: reload crypt table with iv_mode="bogusiv" (not in ivgens)
[*] firing reload with invalid iv_mode (priv published, then notsup)...
[*] reload returned rv=45 (Operation not supported)
[!!!] REACHED HERE = guest survived. On the buggy kernel the guest
      should have panicked in mpipe_done() during destroy.
RUN_EXIT=0
(uptime: 1:35PM up 4 mins, guest healthy)

run #2 (determinism):
[*] reload returned rv=45 (Operation not supported)
RUN2_EXIT=0

run #3 (determinism):
[*] reload returned rv=45 (Operation not supported)
RUN3_EXIT=0

--- dmesg (guest, after patched runs) ---
dm_target_crypt: Successfully initialized
md1: Malloc disk
dm_target_crypt: using crypto_cipher: AES-XTS (in software)
dm_target_crypt: iv_mode='bogusiv' unsupported
dm_target_crypt: ENOTSUP
<<< NO panic; init error path returns cleanly; destroy is a no-op on NULL fields >>>