== DF-4008 replication: two enabled diag buffer types ==
1) REGISTER uid=0xA type=TRACE size=0x100000 (1MB)
   TRACE.size=1048576 live_alloc=1048576
2) REGISTER uid=0xB type=SNAPSHOT size=0x1000 (4KB)
   tag_create=2 mem_alloc=2 (prior tag+buffer LEAKED); live_alloc now 4096 bytes, but TRACE.size is still 1048576
3) READ uid=0xA off=0 bytes=0x100000
  [read uid=0xa] copyout OOB READ: bound check used stale size=1048576 but live allocation is 4096 bytes -> 1044480 bytes past the end disclosed to user (mpr_user.c:1798 vs 1814)
4) UNREGISTER uid=0xA (TRACE)
   shared trio freed: mem_free=1 tag_destroy=1 — this was SNAPSHOT's allocation (cross-type free)
5) READ uid=0xB off=0 bytes=0x1000
  [read uid=0xb] bus_dmamap_sync(NULL) => KERNEL NULL-DEREF PANIC here (mpr_user.c:1805)
== replication complete ==