DF-4020 out-of-aperture read evidence (RUN 2, operator uid=2).

REG_MEM_READ at offsets past the 4 KiB BAR role executed inside the inline
volatile load and returned kernel-memory contents to userland in RegData,
with no device and no bound involved.  On this boot the module's 64 KiB
block was freshly M_ZERO-allocated, so the words past the aperture read back
zero — the unbounded READ primitive itself is proven by the write/read-back
pairs (+0x2000 -> 0xfeedface, +0x3000 -> 0x41414141, replica_run.2.log):

  REG_MEM_READ off=0x1000 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1004 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1008 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x100c -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1010 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1020 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1040 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1080 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1100 -> 0000000000 (uid=2)
  REG_MEM_READ off=0x1104 -> 0000000000 (uid=2)

(the mps twin's equivalent sample — findings/poc/DF-4012/leak_sample.txt —
caught nonzero kmem-arena metadata on a boot where the neighboring pages
were populated: leak[+0x1000] = 0x01000201, 0x010c4212, 0x01104a13, ... ;
same primitive, allocator-state-dependent contents.)

The first read PAST the 64 KiB mapping (+0x10000) faulted instead:
Fatal trap 12, dfmr_ioctl_devsw+0x3d: movl (%rdx),%edx (panic.txt).