--- run 1 baseline ---
== DF-3592 scenario A: WRITE_DATA pkt->count=0 -> (count - 2) underflow spin ==
  WRITE_DATA register walk: count=0 -> loop bound (pkt->count - 2) = 4294967294
  STILL SPINNING after 5,000,000 iterations; kernel walk would continue to ~2^30 before reg wraps invalid (seconds of ioctl CPU)
Packet0 not allowed!
	0xc0003700
	0x00000000
	0x0000a000 <---
	0x00000000
  scenario A parse ret=-1

== DF-3592 scenario B: trailing TYPE3 COND_WRITE header, length_dw=1 ==
  ib->length_dw=1, header=0xc0004500 (type3, count=0, COND_WRITE)
  gfx_check entry reads ib[1]; COND_WRITE reads ib[6] (si.c:4595) — both past the 4-byte allocation
  SIGSEGV at 0x800476001
  OOB READ PROVEN: handler touched a dword beyond ib->length_dw (marker idx=0) — in-kernel this is a silent read past the exact-size sa_bo sub-allocation
exit=42
--- run 2 baseline ---
== DF-3592 scenario A: WRITE_DATA pkt->count=0 -> (count - 2) underflow spin ==
  WRITE_DATA register walk: count=0 -> loop bound (pkt->count - 2) = 4294967294
  STILL SPINNING after 5,000,000 iterations; kernel walk would continue to ~2^30 before reg wraps invalid (seconds of ioctl CPU)
Packet0 not allowed!
	0xc0003700
	0x00000000
	0x0000a000 <---
	0x00000000
  scenario A parse ret=-1

== DF-3592 scenario B: trailing TYPE3 COND_WRITE header, length_dw=1 ==
  ib->length_dw=1, header=0xc0004500 (type3, count=0, COND_WRITE)
  gfx_check entry reads ib[1]; COND_WRITE reads ib[6] (si.c:4595) — both past the 4-byte allocation
  SIGSEGV at 0x800476001
  OOB READ PROVEN: handler touched a dword beyond ib->length_dw (marker idx=0) — in-kernel this is a silent read past the exact-size sa_bo sub-allocation
exit=42
--- run 3 baseline ---
== DF-3592 scenario A: WRITE_DATA pkt->count=0 -> (count - 2) underflow spin ==
  WRITE_DATA register walk: count=0 -> loop bound (pkt->count - 2) = 4294967294
  STILL SPINNING after 5,000,000 iterations; kernel walk would continue to ~2^30 before reg wraps invalid (seconds of ioctl CPU)
Packet0 not allowed!
	0xc0003700
	0x00000000
	0x0000a000 <---
	0x00000000
  scenario A parse ret=-1

== DF-3592 scenario B: trailing TYPE3 COND_WRITE header, length_dw=1 ==
  ib->length_dw=1, header=0xc0004500 (type3, count=0, COND_WRITE)
  gfx_check entry reads ib[1]; COND_WRITE reads ib[6] (si.c:4595) — both past the 4-byte allocation
  SIGSEGV at 0x800476001
  OOB READ PROVEN: handler touched a dword beyond ib->length_dw (marker idx=0) — in-kernel this is a silent read past the exact-size sa_bo sub-allocation
exit=42