== case A: final TLV len=5 (unaligned) at image end == [harness] mode A: image 113 bytes ending at guard page; entering verbatim iwm_read_firmware walk [harness] iter 1: TLV at 88 (buf+88) type 27 len 4 -> remaining len field = 13 (0xd) [harness] iter 2: TLV at 100 (buf+100) type 19 len 5 -> remaining len field = 18446744073709551613 (0xfffffffffffffffd) exit status: 139 == case B: file shorter than sizeof(iwm_tlv_ucode_header) == Segmentation fault (core dumped) [harness] mode B: image 40 bytes ending at guard page; entering verbatim iwm_read_firmware walk exit status: 139 Segmentation fault (core dumped)