# DF-4592 leak samples: bytes of vinum_conf.plex[-1].name (heap before plex[])
# captured in the "plex" name field of the on-disk config line for detached sd det1.
#
# Fresh-boot baseline (run.log, stock module):
#   strings: "sd name det1 drive d1 plex " <cut — first leaked byte non-printable/NUL-adjacent>
#   hexdump: 31 20 70 6c 65 78 20 20 6c 65 6e  = "1 plex " + 0x20 (leaked byte) + "len"
#            -> plex[-1].name[0] == 0x20
#
# Discovery run (earlier same guest, heap layout differed):
#   hexdump: 31 20 70 6c 65 78 20 01 20 6c 65 6e  = "1 plex " + 0x01 + " len"
#            -> plex[-1].name[0] == 0x01
#
# After growing plexes_allocated 8 -> 16 (9 extra plexes force EXPAND/krealloc,
# array moves), a newly created detached sd read a DIFFERENT byte (0x20 again
# at the new location) -- the leaked value tracks the plex[] heap block.
#
# Zero plexes were configured in every dump, so any byte in the field is
# out-of-bounds heap by construction.