2
### TEST 33
== DF-2505 BCA: hostile drive length 188 vs 192-byte `d` allocation (try 1/6) [placed in guard hole] ==
production acd_read_structure() rc=0; d=0xfffff8008d349e50 (want hole 0xfffff8008d349e50, HIT) transfer 192 bytes; s=0xfffff801187c7f00 (2060-byte M_IOCTLOPS)
  BCA: s=0xfffff801187c7f00 sizeof(struct dvd_struct)=2060 s->length=188 (drive-claimed, ntohs)
  data window [0,188): payload 0xC3 x188, guard-marker 0xAA x0, other-nonzero x0
  destination side: 0/10 0xBB guard chunks after s smashed
  NOTE: no 0xAA beyond 188 (markers absent -- placement missed?); non-payload-nonzero x0
last_rc=0


### TEST 30
== DF-2505 BCA: hostile drive length 4096 vs 192-byte `d` allocation (try 1/6) [placed in guard hole] ==
production acd_read_structure() rc=0; d=0xfffff8008d349b50 (want hole 0xfffff8008d349b50, HIT) transfer 192 bytes; s=0xfffff801187c9100 (2060-byte M_IOCTLOPS)
  BCA: s=0xfffff801187c9100 sizeof(struct dvd_struct)=2060 s->length=4096 (drive-claimed, ntohs)
  data window [0,4096): payload 0xC3 x188, guard-marker 0xAA x3908, other-nonzero x0
  0xAA markers span [188..4095] -- FIRST OOB marker at +188 (in-bounds data is [0,188))
  destination side: 1/10 0xBB guard chunks after s smashed -- WRITE past the 2060-byte M_IOCTLOPS buffer
  PROOF (OOB READ): bcopy read past the 192-byte `d` allocation -- 0xAA guard bytes planted OUTSIDE d appear at data[188..] (atapi-cd.c:1583-1584)
last_rc=1


### TEST 31
== DF-2505 MANUFACT: hostile drive length 3000 vs 2052-byte `d` allocation (try 1/6) [0xAA marker chunks carved after d from the seam] ==
production acd_read_structure() rc=0; d=0xfffff801187fe700 (want hole 0xfffff801187b4500, MISS) transfer 2052 bytes; s=0xfffff801187fde00 (2060-byte M_IOCTLOPS)
seam-carved markers: 12 chunks at 0xfffff801187ff000..0xfffff801187e5b00 (stride 2052) -- d=0xfffff801187fe700
  MANUFACT: s=0xfffff801187fde00 sizeof(struct dvd_struct)=2060 s->length=3000 (drive-claimed, ntohs)
  data window [0,3000): payload 0xC3 x2048, guard-marker 0xAA x700, other-nonzero x0
  0xAA markers span [2300..2999] -- FIRST OOB marker at +2300 (in-bounds data is [0,2048))
  destination side: 0/10 0xBB guard chunks after s smashed
  PROOF (OOB READ): bcopy read past the 2052-byte `d` allocation -- 0xAA guard bytes planted OUTSIDE d appear at data[2300..] (atapi-cd.c:1583-1584)
last_rc=1


### TEST 32
== DF-2505 BCA: hostile drive length 65535 vs 192-byte `d` allocation (try 1/6) [placed in guard hole] ==
production acd_read_structure() rc=0; d=0xfffff8008d34a090 (want hole 0xfffff8008d34a090, HIT) transfer 192 bytes; s=0xfffff80118a20000 (2060-byte M_IOCTLOPS, big container)
  BCA: s=0xfffff80118a20000 sizeof(struct dvd_struct)=2060 s->length=65535 (drive-claimed, ntohs)
  data window [0,65535): payload 0xC3 x188, guard-marker 0xAA x14784, other-nonzero x0
  0xAA markers span [188..14971] -- FIRST OOB marker at +188 (in-bounds data is [0,188))
  PROOF (OOB READ): bcopy read past the 192-byte `d` allocation -- 0xAA guard bytes planted OUTSIDE d appear at data[188..] (atapi-cd.c:1583-1584)
last_rc=1


dfrig4_acd: loaded (production atapi-cd.c compiled in; kern.dfrig4_acd_test=30|31|32|33)
dfrig4_acd: loaded (production atapi-cd.c compiled in; kern.dfrig4_acd_test=30|31|32|33)
dfrig4_acd: loaded (production atapi-cd.c compiled in; kern.dfrig4_acd_test=30|31|32|33)