DF-4673 fix A/B — DF467XFIX kernel (fixed production grow path in-kernel).
Precondition identical to the baseline decisive run: root sprays 2600 MiB
of "ROOTSECR"-marked anon pages and exits (PQ_FREE, contents intact).

== attack (unpriv): fixcheck4673 (one MAX-geometry grow: rows=2046,
   cols=1022, frames=32 -> 32,673 pages = 127.6 MiB; exceeds any
   DMA-reserve fragment -> served by the pfn-ascending PQ scan, i.e. the
   same recycled-page pool as the baseline)
spray: dirtied 2600 MiB with tag=77 markers
grew to 32673 pages (127.6 MiB)
scanned 32673 pages: 0 nonzero, 0 kptr pages, 0 ROOT-SECRET pages
ALL CLEAN (bzero at install verified; buffer entirely zero)

BASELINE (stock kernel): 14,117 of 16,444 scanned pages carried the ROOT
secret.  FIXED: every page zeroed at install; disclosure GONE.

residual (documented in fix.diff): poc_race --holdcheck on the fixed
kernel: 0/64 old markers (pages properly recycled) but the held mapping
is STILL WRITABLE onto the now-reused pages -- the old-style device pager
pins nothing; complete fix requires pager-referenced buffer lifetimes.