=== DF-4535 baseline, IRQ mode (guest boot #1, unpatched lpt.ko) ===
# smoke write first: printf "HELLO-LPT-0123456789\n" > /dev/lpt0 -> WRITE-OK
# host capture: 21 bytes "HELLO-LPT-0123456789\n"

$ ./lpt_uioleak 10 &
$ sleep 8; ps -ax -o pid,stat,wchan,comm | grep lpt_uioleak
   PID STAT   WCHAN    UCOMM
   888 R4     -        lpt_uioleak          <-- kernel-bound, syscall never returned
$ kill -9 888; sleep 1; process gone (SIGKILL worked -- PCATCH on the IRQ path)

stdout of the run:
[*] opened /dev/lpt0 (irq mode)
[*] phase1: wrote 4096 'A' bytes (kernel buffer now 'A')
[*] phase2: write(fd, 8192) with PROT_NONE guard page at 4096
[*] expecting syscall to NEVER return; will be killed after 10s

host-side port capture analysis (python, verbatim):
total bytes: 141333
after smoke prefix: 141312
[+] phase1: 4096 'A' OK
[+] phase2: 4096 valid 'B' bytes copied and sent OK
tail length: 133120  tail composition: Counter({66: 133120})
num full 1024-blocks in tail: 130
--> 133,120 bytes of STALE kernel buffer content strobed out the port
    after the write()'s valid data was exhausted.  Livelock confirmed:
    the file kept growing until SIGKILL.

=== DF-4535 baseline, polled mode (guest boot #1, after ioctl LPT_IRQ=0) ===
kernel log: "lpt0: switched to polled standard mode"
run started; 8s later kill -9 sent; guest stopped accepting new ssh:
  "Connection timed out during banner exchange"   (x2, 30s apart)
console (boot.log tail): no panic; last line = "switched to polled standard mode"
host-side capture growth during polled run: 2,183,288 bytes
composition: 'B'x1,848,440 (stale, from the last copied chunk)
             'W'x322,560   (in-flight chunks of the earlier close_lifetime hammer)
             'A'x4,096     (valid phase-1)
system required force-reset (vm.sh reset).

=== DF-4535 PATCHED module (fix.diff applied, lpt.ko rebuilt, reboot) ===
$ ./lpt_uioleak 10
[*] opened /dev/lpt0 (irq mode)
[*] phase1: wrote 4096 'A' bytes (kernel buffer now 'A')
[*] phase2: write(fd, 8192) with PROT_NONE guard page at 4096
[!] UNEXPECTED: write returned -1 errno=14 after 1s      <-- correct EFAULT now
EXIT=6
capture delta = 8192 bytes exactly:
A*4096: True B*4096: True no-stale-tail: True
$ printf "NORMAL-WRITE-STILL-OK\n" > /dev/lpt0 && echo NORMAL-WRITE-OK   # still works