# guest: DragonFly dfbsd 6.5-DEVELOPME3987T #0 Thu Jul  2 06:02:54 UTC 2026 x86_64
# build: cc -O2 -Wall -Wextra -o /tmp/tr3987 /tmp/t3987.c   (guest cc 8.3 [DragonFly])
# run:   /tmp/tr3987   (as root via vm.sh run_root)
$ /tmp/tr3987

DF-3987 model: poisoned cur_link_settings.lane_count ->
  (A) dp_test_send_phy_test_pattern lane_settings[] OOB WRITE
  (B) hpd_rx_irq_check_link_loss_status OOB READ

DP_TEST_LANE_COUNT=0x01 -> cur/verified lane_count=1
  [A] in-bounds (lane_count<=4)

DP_TEST_LANE_COUNT=0x02 -> cur/verified lane_count=2
  [A] in-bounds (lane_count<=4)

DP_TEST_LANE_COUNT=0x04 -> cur/verified lane_count=4
  [A] in-bounds (lane_count<=4)

DP_TEST_LANE_COUNT=0x05 -> cur/verified lane_count=5
  [A] lane_settings[5] write past [4]: 12 bytes OOB WRITE (total span 60 B, values 0..3 per word) [stack SMASH -> panic]
  [A2] dpcd_lane_adjustment read idx 2 past [2]: 1 bytes OOB READ
  [B] lane01_status read idx 2 vs union size 6: in-bounds (0 bytes past) [stack READ, branch-only]

DP_TEST_LANE_COUNT=0x1f -> cur/verified lane_count=31
  [A] lane_settings[31] write past [4]: 324 bytes OOB WRITE (total span 372 B, values 0..3 per word) [stack SMASH -> panic]
  [A2] dpcd_lane_adjustment read idx 15 past [2]: 14 bytes OOB READ
  [B] lane01_status read idx 15 vs union size 6: OOB READ (10 bytes past) [stack READ, branch-only]

DP_TEST_LANE_COUNT=0x20 -> cur/verified lane_count=32
  [A] lane_settings[32] write past [4]: 336 bytes OOB WRITE (total span 384 B, values 0..3 per word) [stack SMASH -> panic]
  [A2] dpcd_lane_adjustment read idx 15 past [2]: 14 bytes OOB READ
  [B] lane01_status read idx 15 vs union size 6: OOB READ (10 bytes past) [stack READ, branch-only]

DP_TEST_LANE_COUNT=0x7f -> cur/verified lane_count=127
  [A] lane_settings[127] write past [4]: 1476 bytes OOB WRITE (total span 1524 B, values 0..3 per word) [stack SMASH -> panic]
  [A2] dpcd_lane_adjustment read idx 63 past [2]: 62 bytes OOB READ
  [B] lane01_status read idx 63 vs union size 6: OOB READ (58 bytes past) [stack READ, branch-only]

DP_TEST_LANE_COUNT=0xff -> cur/verified lane_count=255
  [A] lane_settings[255] write past [4]: 3012 bytes OOB WRITE (total span 3060 B, values 0..3 per word) [stack SMASH -> panic]
  [A2] dpcd_lane_adjustment read idx 127 past [2]: 126 bytes OOB READ
  [B] lane01_status read idx 127 vs union size 6: OOB READ (122 bytes past) [stack READ, branch-only]

TRIGGER_RC=0 (model OK; hardware-gated on this guest: no AMD GPU)
RC_3987=0