V26: cmd=3 invoked by pid 1014 (sysctl)
V26[3] blist(65): bl_blocks=65 bl_rootblks=5
V26[3] after init: alloc(64) -> 0, alloc(1) -> 64 (all 65 real blocks allocated)
V26[3] blist_free(128,64) OUT OF RANGE returned with NO "freeing unexpected range" panic (meta guard checks PARENT: dead code)
V26[3] alloc(64) -> 128 *** OUT-OF-RANGE BLOCK GRANTED (bl_blocks=65) ***
V26[3] alloc(64) after re-free -> 128 *** SAME BLOCK GRANTED TWICE (overlapping allocation) ***
---
V26: cmd=7 invoked by pid 921 (sysctl)
V26[7] blist(2081): rootblks=69
V26[7] drained blist via alloc(64)/alloc(1): 2081 blocks (all real blocks allocated)
V26[7] free(2112,64) into terminator slot: NO panic
V26[7] alloc(64) #1 -> 2112 *** OUT-OF-RANGE BLOCK (bl_blocks=2081) ***
V26[7] alloc(64) #2 -> 2112 *** SAME BLOCK GRANTED TWICE (overlapping allocation) ***
---
V26: cmd=8 (separate boot)
V26[8] blist(2081) rootblks=69 root=0xfffff801184fb500
V26[8] init done. root[100] is 1600 bytes past the 1104-byte bl_root allocation
V26[8] BEFORE: root[100].avail=0 bighint=0 root[101].avail=0
V26[8] calling blist_free(6144, 2048): root child index 100 is PAST bl_rootblks=69 - OOB walk...
V26[8] AFTER: root[100].avail=0x800 bighint=0x800 root[101].avail=0
V26[8] SURVIVED free(6144,2048) (OOB writes land in slab slack; values above prove the walk wrote past bl_root)
---
first-attempt panic (ungroomed terminator garbage bitmap):
panic: blst_leaf_free: freeing free block
Trace: blst_meta_free() -> blist_free() -> v26_sysctl() -> sysctl_root -> userland_sysctl -> sys___sysctl