===== stock (audited kernel code) =====
sizeof(EXPN_DATA_PER_XPD_5112)      = 20
sizeof(EXPN_DATA_PER_CHANNEL_5112)  = 84
wild index 0xDEAD = 57005 -> byte offset +1140100 from a pDataPerXPD[] base

[run1] eepromExpandPower5112 returned AH_TRUE
[run1] pDataPerChannel=0x800a00004 alloc_end=0x800a00060 numChannels=1
[run1] damaged bytes past allocation: 18 (first at pDataPerChannel+1140106)
[run1] expected wild XPD base: pDataPerChannel+1140104 (4 + 0xDEAD * 20)
[run1] bytes at the wild site (+1140106..+1140124):
    04 00 2a 00 3f 00 49 00 4e 00 2c 00 30 00 34 00 38 00
[run2] pDataPerChannel=0x800a00008 alloc_end=0x800a00110 numChannels=3
[run2] damaged bytes past allocation: 54 (first at pDataPerChannel+1140106)
[run2] expected wild XPD base: pDataPerChannel+1140104 (4 + 0xDEAD * 20)
[run2] bytes at the wild site (+1140106..+1140124):
    04 00 2a 00 3f 00 49 00 4e 00 2c 00 30 00 34 00 38 00

FAIL: wild OOB write WAS observed
exit=42

===== with fix.diff applied =====
sizeof(EXPN_DATA_PER_XPD_5112)      = 20
sizeof(EXPN_DATA_PER_CHANNEL_5112)  = 84
wild index 0xDEAD = 57005 -> byte offset +1140100 from a pDataPerXPD[] base

[run1] eepromExpandPower5112 returned AH_FALSE
[run1] pDataPerChannel=0x800a00004 alloc_end=0x800a00060 numChannels=1
[run1] damaged bytes past allocation: 0 (first at pDataPerChannel+0)
[run2] pDataPerChannel=0x800a00008 alloc_end=0x800a00110 numChannels=3
[run2] damaged bytes past allocation: 0 (first at pDataPerChannel+0)

PASS: wild OOB write was NOT observed
exit=0

RESULT: bug reproduced on stock, GONE with fix