DF2553: === trigger mode=2 ===
DF2553[mode2]: faithful kmalloc(0x100000001) = 0 (NULL: a faithful 4GiB+1 allocation is impossible here)
DF2553[mode2]: truncated (int)(0x100000001)=1 kmalloc = 0xfffff8004f0c2970 usable=8
DF2553: === mode=2 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 0 @0xfffff8004f0c2970 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=22 (unexpected)
DF2553[mode1]: uio after: resid=0x100000000 iov0.len=512 iov1.len=4294966784  => 0 attacker bytes were copied into s_buf before the fault
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553[mode1]: no corruption observed
DF2553: === mode=1 done ===
DF2553: === trigger mode=0 ===
DF2553[mode0]: control uio_resid=256 (0x100)
DF2553[mode0]: OK s=0xfffff8008976ba00 err=0 s_size=257 s_len=256 data[0..7]=44 46 32 35 35 33 50 57
DF2553[mode0]: uio_resid after=0 (fully drained)
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553: === mode=0 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 0 @0xfffff8004f0c2970 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=22 (unexpected)
DF2553[mode1]: uio after: resid=0x100000000 iov0.len=512 iov1.len=4294966784  => 0 attacker bytes were copied into s_buf before the fault
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553[mode1]: no corruption observed
DF2553: === mode=1 done ===