=== RUN DF-3785 ===
struct eeProm: bytes[256]; ioctl arg buffer = 260 bytes (kmalloc M_IOCTLOPS)
offset=-32511 count=32767 eepromSize=8 max=256
guard: (offset+count)=256 > max=256 ? no -> PASSES
readEEProm rc=0; wrote 32767 bytes into bytes[256] -> 32511 bytes past the 260-byte heap buffer
first OOB write at ioctl-buffer offset 260 (allocation 260) -- driver state: 32511 bytes past end
CONFIRMED: guard is bypassable with negative offset; count up to 32767 accepted
RC=0