== DF-4363 build (guest maxx, 6.5-DEVELOPMENT) ==
BUILD_EXIT=0
BUILD_FIXED_EXIT=0

== DF-4363 decisive runs ==
== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 24 dwords
-> cm->cm_length (PageLength*4) = 96 bytes  (mps_config.c:249)
[BUGGY] IOC DMA of 96 bytes into the 92-byte page (mps.c:2099-2101 dmamap_load of cm_data/cm_length) ...
>>> SIGSEGV/11 caught: IOC DMA wrote past the 92-byte heap allocation (guard page hit)
>>> PRIMITIVE CONFIRMED: firmware PageLength=24 (cm_length=96) overflows the 0x5C MPS_MAN_PAGE10_SIZE buffer by 4 bytes.
>>> This is the exact code at sys/dev/raid/mps/mps_config.c:249,254,260 (mps.c:2099-2101 builds the DMA over cm_length).
RUN24_EXIT=1

== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 23 dwords
-> cm->cm_length (PageLength*4) = 92 bytes  (mps_config.c:249)
[OK] IOC DMA of 92 bytes fits the 92-byte page exactly
page->ProductSpecificInfo OEM = 0x80, pPS_info[5] hide/expose = 0x03
no overflow: DMA stayed inside the allocation
RUN23_EXIT=0

== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 255 dwords
-> cm->cm_length (PageLength*4) = 1020 bytes  (mps_config.c:249)
[BUGGY] IOC DMA of 1020 bytes into the 92-byte page (mps.c:2099-2101 dmamap_load of cm_data/cm_length) ...
>>> SIGSEGV/11 caught: IOC DMA wrote past the 92-byte heap allocation (guard page hit)
>>> PRIMITIVE CONFIRMED: firmware PageLength=255 (cm_length=1020) overflows the 0x5C MPS_MAN_PAGE10_SIZE buffer by 928 bytes.
>>> This is the exact code at sys/dev/raid/mps/mps_config.c:249,254,260 (mps.c:2099-2101 builds the DMA over cm_length).
RUN255_EXIT=1

== DF-4363 fixed-validation runs ==
== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 24 dwords
-> cm->cm_length (PageLength*4) = 96 bytes  (mps_config.c:249)
[FIXED] kmalloc sized MAX(cm_length, 0x5C) = 96 + length floor guard (fix.diff)
[BUGGY] IOC DMA of 96 bytes into the 92-byte page (mps.c:2099-2101 dmamap_load of cm_data/cm_length) ...
page->ProductSpecificInfo OEM = 0x80, pPS_info[5] hide/expose = 0x03
no overflow: DMA stayed inside the allocation
F24=0
== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 255 dwords
-> cm->cm_length (PageLength*4) = 1020 bytes  (mps_config.c:249)
[FIXED] kmalloc sized MAX(cm_length, 0x5C) = 1020 + length floor guard (fix.diff)
[BUGGY] IOC DMA of 1020 bytes into the 92-byte page (mps.c:2099-2101 dmamap_load of cm_data/cm_length) ...
page->ProductSpecificInfo OEM = 0x80, pPS_info[5] hide/expose = 0x03
no overflow: DMA stayed inside the allocation
F255=0
== DF-4363 harness: mps_config_get_man_pg10 DMA heap overflow ==
kernel MPS_MAN_PAGE10_SIZE     = 0x5C (92)  (mpsvar.h:105)
firmware Manufacturing Pg10 PageLength = 4 dwords
-> cm->cm_length (PageLength*4) = 16 bytes  (mps_config.c:249)
[FIXED] kmalloc sized MAX(cm_length, 0x5C) = 92 + length floor guard (fix.diff)
[FIXED] page shorter than ProductSpecificInfo[5] needs -> EINVAL (fix.diff hunk 2)
F4=0