0
baseline sets = 0
case A (payload=1B=5, stale bytes 00 00 00): sets=0x20 (delta 0x20)
case B (payload=1B=5, stale bytes 01 01 00): sets=0 (delta 0)
DF2593: OOB READ CONFIRMED -- bytes past sopt_valsize decided the toggle
control (4-byte payload, junk pad): delta=0x20 (pad ignored as it should be)