[*] sp->pp_comp = 0xfffff801183b2e00, sizeof=4656
[*] sprayed 64 x 4656-byte chunks (same size class)
---- BEFORE weapon: rstate[10..] tail (expect zeros) @ 0xfffff801183b3d3c ----
fffff801183b3d3c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d4c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d5c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d6c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d7c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d8c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d9c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3dac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[*] SIOCGIFFLAGS rc=0 flags=0xffff8010
[*] SIOCSIFFLAGS(up) rc=0
[.] try 0: ACK id=1
[+] LCP OPENED
>>> WEAPON: IPCP VJ Max-Slot-Id=255
---- AFTER weapon: rstate tail + past-end @ 0xfffff801183b3d3c ----
fffff801183b3d3c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d4c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d5c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d6c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d7c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d8c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3d9c: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3dac: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3dbc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b3dcc: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
---- AFTER weapon: allocation end +0..64 (OOB) @ 0xfffff801183b4020 ----
fffff801183b4020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b4030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b4040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
fffff801183b4050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[*] freeing sprayed chunks (touches corrupted zones)
[*] unspray done, alive
[!] survived
exit=0

# SAME driver, SAME weapon frame, on the fix.diff-patched sppp.ko:
# AFTER == BEFORE: all zeros, including the past-the-end window.
# No sl_compress_init OOB; the option is NAKed (clamped to MAX_STATES-1).
# The link continues negotiating normally.  Fix validated.