sizeof(tulip_media_info_t)=28 (kernel: 28 on x86-64)
blocks=23 (SROM byte), tulip_mediainfo[] has 10 slots

block 10: OOB write at tulip_mediainfo[10] (+0 bytes past array end): mi_gpdata=0x4b
block 11: OOB write at tulip_mediainfo[11] (+28 bytes past array end): mi_gpdata=0x4c
block 12: OOB write at tulip_mediainfo[12] (+56 bytes past array end): mi_gpdata=0x4d
block 13: OOB write at tulip_mediainfo[13] (+84 bytes past array end): mi_gpdata=0x4e
block 14: OOB write at tulip_mediainfo[14] (+112 bytes past array end): mi_gpdata=0x4f
block 15: OOB write at tulip_mediainfo[15] (+140 bytes past array end): mi_gpdata=0x50
block 16: OOB write at tulip_mediainfo[16] (+168 bytes past array end): mi_gpdata=0x51
block 17: OOB write at tulip_mediainfo[17] (+196 bytes past array end): mi_gpdata=0x52
block 18: OOB write at tulip_mediainfo[18] (+224 bytes past array end): mi_gpdata=0x53
block 19: OOB write at tulip_mediainfo[19] (+252 bytes past array end): mi_gpdata=0x54
block 20: OOB write at tulip_mediainfo[20] (+280 bytes past array end): mi_gpdata=0x55
block 21: OOB write at tulip_mediainfo[21] (+308 bytes past array end): mi_gpdata=0x56
block 22: OOB write at tulip_mediainfo[22] (+336 bytes past array end): mi_gpdata=0x57

OOB writes performed: 13 (all past tulip_mediainfo[9])
mi finished at tulip_mediainfo[23] = +364 bytes past end

--- softc members after tulip_mediainfo[10] ---
tulip_setup_tag      CLOBBERED (0xa1a1a1a100000001)
tulip_setup_map      CLOBBERED (0x0000004ba2a2a2a2)
tulip_setup_dma_addr INTACT (0xa3a3a3a3a3a3a3a3)
tulip_setupbuf       CLOBBERED (0x00000001a4a4a4a4)  <- real kernel: bus-mapped DMA buffer ptr
tulip_setupdata[48]  13/48 words CLOBBERED with SROM bytes
tulip_boardid[24]    8/24 bytes CLOBBERED
tulip_rombuf[128]    (source image; kernel path also runs OOB here = DF-1205)

SUCCESS-CRITERION: >=1 OOB write past tulip_mediainfo[10] -> logic model of if_de.c:2223 defect CONFIRMED
exit=0