path 0: record@img+0x0000 -> path_size=0x6666 (image is 4096 bytes)
path 1: record@img+0x6666  <-- record OOB (past image) -> path_size=0x6666 (image is 4096 bytes)
path 2: record@img+0x6666  <-- record OOB (past image) -> path_size=0x6666 (image is 4096 bytes)
encoder record @+0xfff0 (image is 4096 bytes): type=0 size=0 — OOB deref
*num_dst_objs=255, no match -> enum_id=255 ; ucMuxState[255] read is 253 bytes past the 2-byte array (:732/:740)
hop 1: record@+4110 is 15 bytes past image end — still walked
record chain ran 1 hops, final offset +4110 (15 bytes past image), stopped only on non-record garbage
total modeled OOB byte reads: 11
REPRODUCED (harness): object-table OOB reads from unvalidated offsets/indices
exit_code=0