# DF-4165 fix validation (A/B in the verbatim rig, identical crafted image)
# baseline = byte-identical production slice; fixed = same slice + fix.diff clamps

===== [BASELINE] MODE layout =====
----- rc=0 -----
===== [BASELINE] MODE dest-guard =====
[rig] SIGSEGV mode=dest-guard fix=baseline si_addr=0x800486000
[rig] fault offset in kzalloc'd struct integrated_info: 692 (sizeof=692) -> 0 bytes PAST the allocation end => OUT-OF-BOUNDS WRITE
[rig] fault offset in BIOS image: -4096 (bios_size=12288) => in image?!
----- rc=88 -----
===== [BASELINE] MODE src-guard =====
[rig] SIGSEGV mode=src-guard fix=baseline si_addr=0x80048e000
[rig] fault offset in BIOS image: 4096 (bios_size=4096) => READ BEYOND BIOS IMAGE (OOB READ)
----- rc=88 -----
===== [BASELINE] MODE canary =====
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 400/512  first@victim+0 (struct+692, 0 past struct end)  last@victim+399 (399 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 400 match / 0 mismatch
[rig] stored counts: dp0=255/0 dp1=0/0 dp2=0/0 dp3=0/0 (hdmi/6g)
[rig] RESULT: ADJACENT-OBJECT CORRUPTION (every changed byte equals the crafted VBIOS byte)
----- rc=0 -----
===== [BASELINE] MODE canary6g =====
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 500/512  first@victim+0 (struct+692, 0 past struct end)  last@victim+499 (499 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 500 match / 0 mismatch
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/255 (hdmi/6g)
[rig] RESULT: ADJACENT-OBJECT CORRUPTION (every changed byte equals the crafted VBIOS byte)
----- rc=0 -----

==================== FIXED BUILD ====================
===== [FIXED] MODE layout =====
----- rc=0 -----
===== [FIXED] MODE dest-guard =====
[rig] <- returned 0x800485d4c (BP_RESULT_OK path)
[rig] stored counts: dp0=9/3 dp1=9/3 dp2=9/3 dp3=9/3
[rig] GOOD: no fault with DF-4165 clamps active (expected)
----- rc=0 -----
===== [FIXED] MODE src-guard =====
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/3
[rig] GOOD: no fault with DF-4165 clamps active (expected)
----- rc=0 -----
===== [FIXED] MODE canary =====
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 0/512  first@victim+18446744073709551615 (struct+691, 18446744073709551615 past struct end)  last@victim+0 (0 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 0 match / 0 mismatch
[rig] stored counts: dp0=9/0 dp1=0/0 dp2=0/0 dp3=0/0 (hdmi/6g)
[rig] RESULT: victim intact (no overflow)
----- rc=0 -----
===== [FIXED] MODE canary6g =====
[rig] <- returned 0x800485000 (BP_RESULT_OK path)
[rig] VICTIM bytes changed: 0/512  first@victim+18446744073709551615 (struct+691, 18446744073709551615 past struct end)  last@victim+0 (0 past end)
[rig] VICTIM content == crafted-image byte at the exact source position: 0 match / 0 mismatch
[rig] stored counts: dp0=0/0 dp1=0/0 dp2=0/0 dp3=0/3 (hdmi/6g)
[rig] RESULT: victim intact (no overflow)
----- rc=0 -----