== mode 1: truncated trailing entry (heap OOB read+write) ==
mode=oob: buffer=18 live ints (72 bytes = reg_list_format_size_bytes)
last live word [17] = 0xb0000 != 0xFFFFFFFF -> parser does ind_offset += 2
then READS  register_list_format[19]  (4-8 bytes past end)
then WRITES register_list_format[19] = indices  (heap OOB WRITE)
RESULT: canary at live-index 19 (byte +4 past allocation) CLOBBERED to 0x1
HEAP OOB WRITE CONFIRMED (value written = small index int, offset 4 bytes past end)
exit=1
== mode 2: 8 unique indirect indices (BUG_ON panic) ==
mode=bugon: list_size=38 elems, 8 unique indirect indices
  [BUG_ON fired: kernel would PANIC here]
indices_count=8 bugon_fired=1 -> PANIC (BUG_ON) proven
exit=2