[v1 walk] self-declared size=0xfff8 vs real table=64 bytes (image=96): walked 16291 objects, 16290 of them entirely past the table; 16290 reads landed past the image end
[stride] v1 advances 7 bytes for 3 entries; v2 advances 16 — v1 lands 9 bytes early on EVERY subsequent object (mis-parse / wrong object returned)
[leakage] vddc_buf[253*255+254] = element 64769 of 510-byte arrays -> 129538 bytes past array base (image is 96 bytes)
modeled OOB u16 reads: 16290
REPRODUCED (harness): voltage-object walks read past table/image on self-declared sizes and indices
exit_code=0