-- fix validation: vm.sh reset with-src; fix.diff applied to /usr/src;
   ng_socket.ko + ng_hole.ko rebuilt (-Werror clean); exact PoC re-run --

=== hole_oob on FIXED kernel ===
hole_oob: uid=0
STEP socket node named oob
STEP data socket connected to oob
STEP mkpeer hole S.a<->hole.abcde1
STEP sent 5-byte packet into hole hook
STEP sanity getstats: token=22531 frames=1 octets=5
STEP negative control: unterminated full-length -> sendto errno=22 (-errno=-22, ENOENT=2 = no match)
RESULT oob_matches=0/256 enoent=1 rejected=256 other=0
RESULT fixed behavior: under-sent requests rejected with EINVAL at the socket (no OOB possible)

=== echo_neg on FIXED kernel (regression smoke) ===
STEP B: e1:q -> response returned to sender: token=57355 flags=0x1 cookie=851672669 (no relay into ring)
STEP B: e2:n -> response returned to sender: token=57356 flags=0x1 cookie=851672669 (no relay into ring)
RESULT SURVIVED: bounced=1 responses=4 guest-alive
RESULT echo-ring inert: no injection channel (data reflects to sender; control responds to sender) -- DF-3557-style FLOW relay absent in ng_echo
FIXRUN_DONE

Notes: sanity well-formed getstats still returns frames=1/octets=5 (no
regression). Negative control now EINVAL(22) -- stopped by the ng_hole
NUL-termination check (it passed the socket check because it sends the
full 32 bytes). A second echo_neg invocation on the same fixed guest
printed "sendto(a) errno=48 (EADDRINUSE)" -- node name "neg" still
registered from the first successful run (PoC re-run friction, not a
kernel issue).