# DF-4396 leak/misparse samples (baseline, decisive lines from run.log — stable across 3 runs)

## kernel-heap leak: vdd_dep_on_socclk entries cloned byte-exact from bytes past the image (socclk-leak-canary)
  vdd_dep_on_socclk->count=40 (image holds 5)
  leak provenance: 35/35 OOB records byte-exact with bytes past the image (0 mismatch)

## gfxclk V2 walk: 38 OOB records byte-exact + od limit bit decided by an OOB byte (gfxclk-v2-leak)
  od: entries[39].ucACGEnable at image+642 (image_len=152) -> OOB victim byte 0x34, in-image rec1 byte 0x00; engineClock=200000 (OOB-expect 200000, in-image-expect 198000) => decision bit == OOB byte (LEAK)
  vdd_dep_on_sclk->count=40 (image holds 2)
  V2-walk provenance: 38 OOB records byte-exact with the bytes past the image (0 mismatch) -> values surface to userland via powerplay sysfs

## heap OOB WRITE provenance: vddc lookup 247/247 writes byte-exact with crafted image (vddc-lookup-canary)
  canary: obj len=84 at 0x8004bb800 -> changed=494 bytes past object, range [+2,+2463]  (OUT-OF-BOUNDS WRITE past kzalloc'd object)
  overwrite provenance: 247/247 OOB us_vdd writes byte-exact equal to crafted image bytes, 0 mismatch
  vddc_lookup_table->count=255 (baseline overflows the 84-byte object with 247 more writes; fixed clamps loop to 8)

## dcefclk pioneer OOB write extent: 228-byte (kmalloc-256) object, overwrite reaches +6892
  canary: obj len=228 at 0x8004bb800 -> changed=1232 bytes past object, range [+0,+6892]  (OUT-OF-BOUNDS WRITE past kzalloc'd object)

## masked failure (DF-3702 feeder, result-clobber)
result-clobber: rc=0 vddc_lookup_table=0x0 vddmem=0x8004c06c0 vddci=0x8004c0690
  MASKED FAILURE PROVEN: parse 'succeeds' (rc=0) with NULL vddc_lookup_table -> consumer NULL-deref (DF-3702 class)

## NULL deref (DF-1587, pcie-null-sclk)
FAULT: sigsegv addr=0x0
  (address below image base: NULL/near-NULL DEREFERENCE)