DF-2746 mincore(vec) off-by-one probe
test1 (all-unmapped range, tail-fill loop):
  vec[-1] = 0x00  (must still be 0x5A)
  vec[0]  = 0x00  (0x00 ok: page unmapped)
  => VULNERABLE: kernel wrote NUL at vec[-1]
test2 (leading hole, gap-fill loop):
  vec[-1] = 0x00  (must still be 0x5A)
  vec[0]  = 0x00  (0x00 ok: page unmapped)
  vec[1]  = 0x1f  (MINCORE_INCORE=1 ok)
  => VULNERABLE: kernel wrote NUL at vec[-1]
RESULT: VULNERABLE (2)
exit=0
RESULT: VULNERABLE (2)
RESULT: VULNERABLE (2)