=== RUN DF-3784 ===
iov_len (read() 3rd arg) = 0x80000000  (valid: (ssize_t)>0)
vbi_read: readsize = (int)iov_len = -2147483648
clamp 'if (readsize > vbisize)' -> readsize still -2147483648 (negative, clamp skipped)
wrap check '(vbistart+readsize) >= VBI_BUFFER_SIZE': -2147483648 >= 1310720 -> false, straight-through branch
uiomove n = (size_t)(int)0x80000000 = 0xffffffff80000000 (18446744071562067968)
uiomove cnt = MIN(iov_len=2GB, n) = 2147483648 bytes copied from vbibuffer+0 to user buffer
=> 2 GiB of kernel virtual memory disclosed from vbibuffer upward until first unmapped page (EFAULT stops it; partial data already in user buffer)
post-state: vbisize=-2147418112 vbistart=-2147483648 (both corrupted by int overflow)
CONFIRMED: no guard rejects a negative readsize in vbi_read
RC=0