>>> FIXED build (fix.diff guard active) <<<
== G4X garbage reserved base (0xABC -> 0x0ABC0000) ==
  stolen (dsm)          : [0xd00000..0x2cfffff] (32 MiB)
  reserved base (reg)   : 0xabc00000   size(raw u64): 0xffffffff57100000
  resource_contains     : PASS
  stolen_usable_size    : 33554432 (1.00x the real 33554432)
  worst-case alloc phys : dsm.start+usable-1 = 0x2cfffff (dsm.end=0x2cfffff => inside stolen)
  FIX VERIFIED: no wrap, no containment bypass, usable (33554432) <= real (33554432); allocations stay inside stolen
== G4X sane reserved base (top 1 MiB of stolen) ==
  stolen (dsm)          : [0xd00000..0x2cfffff] (32 MiB)
  reserved base (reg)   : 0x2c00000   size(raw u64): 0x100000
  resource_contains     : PASS
  stolen_usable_size    : 32505856 (0.97x the real 33554432)
  worst-case alloc phys : dsm.start+usable-1 = 0x2bfffff (dsm.end=0x2cfffff => inside stolen)
  (control: sane firmware base => usable < real; behavior normal)
== BDW garbage reserved base (0xFFF -> 0xFFF00000) ==
  stolen (dsm)          : [0x40000000..0x41ffffff] (32 MiB)
  reserved base (reg)   : 0xfff00000   size(raw u64): 0xffffffff42100000
  resource_contains     : PASS
  stolen_usable_size    : 33554432 (1.00x the real 33554432)
  worst-case alloc phys : dsm.start+usable-1 = 0x41ffffff (dsm.end=0x41ffffff => inside stolen)
  FIX VERIFIED: no wrap, no containment bypass, usable (33554432) <= real (33554432); allocations stay inside stolen

RESULT: ALL CASES OK