DF-4321 discovery trace (-O0, initial 2-range payload, regs[] walked past its
own 2-element array exactly as the kernel walks past the kmalloc'd indata
buffer). Shows `space` negative while the inner/outer loops keep writing:

  val dpoff=63720 space=-63688
  val dpoff=63724 space=-63692
  val dpoff=63728 space=-63696
  ... (continues until SIGSEGV) ...
  val dpoff=63808 space=-63776
Segmentation fault (core dumped)

Mechanism: after an outer iteration begins with space==8, the header takes
8, the do-while's unconditional first value write takes space to -4;
`space >= sizeof(uint32_t)` then converts space (int) to size_t and is
TRUE forever (~2^63 >= 4). Inner loop bounded only by r <= e (user data),
outer loop only by the regs[] array contents (user data / heap garbage).