[dfmm] === scenario: what i915_vma_unbind does with the yielded sentinel ===
[dfmm] reserved top node [fffff000 + 1000] -> 0
[dfmm] reserved mid node [10000000 + 1000] -> 0
[dfmm] calling drm_mm_remove_node(&mm.head_node) (== i915_vma.c:695 on the container_of'ed sentinel)
[dfmm] survived remove of sentinel; probing corrupted state
[dfmm] probe: walk the mid node's own range [10000000, 10001000)
[dfmm] walk [10000000, 10001000) on mm [0, 100000000), mm end = 100000000
[dfmm] probe result: visited=0 head_sentinel=0 (mid node still visible)
[dfmm] probe: insert_node(4K) after corruption -> 0 (start=10001000 size=1000)
[dfmm] probe: hole stack after corruption
[dfmm]   hole [10002000, fffff000) size=efffd000
[dfmm]   hole [100000000, 10000000) size=ffffffff10000000   <== SIZE UNDERFLOW (bogus)
[dfmm] dfmm_poc unloaded