== DF-3996 envy24 emldma OOB — verbatim driver code harness ==
pbuf=163840B (40960 entries) rbuf=196608B (49152 entries)

[S16 start 1blk] unit=4 hwptr=4095 blk=40 ready=16380 readyptr=16380 -> ch->offset=24  (dsize=4096)
[S16 start 1blk] pbuf entries=40960  OOB writes past end: 2  first_entry=41192 (+928 bytes past pbuf)  max_entry=41193 (+932 bytes)
      first OOB value = 0xa7a70000  (user PCM payload)
[S32 start full ] unit=8 hwptr=4095 blk=20 ready=32760 readyptr=32760 -> ch->offset=2050  (dsize=4096)
[S32 start full ] pbuf entries=40960  OOB writes past end: 2  first_entry=61452 (+81968 bytes past pbuf)  max_entry=61453 (+81972 bytes)
      first OOB value = 0xb9b9b9b9  (user PCM payload)
[U8  start full ] unit=2 hwptr=4095 blk=80 ready=8188 readyptr=8188 -> ch->offset=128  (dsize=2048)
[U8  start full ] pbuf entries=40960  OOB writes past end: 2  first_entry=42222 (+5048 bytes past pbuf)  max_entry=42223 (+5052 bytes)
      first OOB value = 0x43000000  (user PCM payload)
[S16 tiny ready ] unit=4 hwptr=4095 blk=40 ready=4096 readyptr=4096 -> ch->offset=24  (dsize=4096)
[S16 tiny ready ] pbuf entries=40960  OOB writes past end: 0  first_entry=-1 (+-163844 bytes past pbuf)  max_entry=-1 (+-163844 bytes)

-- record direction (OOB READ -> userspace leak) --
[S32 rec full] unit=8 hwptr=4095 blk=20 free=32760 freeptr=32760 -> ch->offset=2050 (ssize=4096)
      leaked OOB kernel-heap samples copied to user: 2
[S16 rec full] unit=4 hwptr=4095 blk=40 free=16380 freeptr=16380 -> ch->offset=24 (ssize=2048)
      leaked OOB kernel-heap samples copied to user: 1

-- hard mode (guard page) --
[hard] S32_LE play, offset=2060, readyptr=32764 -> first write idx = 6155*10+2
[hard] SIGFAULT at first OOB write — dmabuf[dst*10+slot] indexed past the 163840-byte pbuf into the guard page (kernel: adjacent heap object).
RUN_RC=0