DF-4777 leaked-bytes sample (run 1 of 3; see run.log for the full census)
— ir_reply[1070..] (first foreign bytes: kernel slab-linkage pointers + marker pattern from adjacent live chunks):
first nonzero beyond 1024 [0x0420]:
  0420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 cf 
  0430: 8d 00 f8 ff ff 60 44 16 4f 00 f8 ff ff 50 44 16 
  0440: 4f 00 f8 ff ff 50 c0 cf 8d 00 f8 ff ff 84 03 00 
  0450: 00 00 00 00 00 d4 c3 cf 8d 00 f8 ff ff 00 04 00 
  0460: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 03 00 
  0470: 00 00 00 00 00 18 01 c6 00 00 00 00 00 44 46 34 

— leak profile, 3 independent runs:
[run.log]
RECEIVE ok: msg.data_len = 16001 (compcode + 16000 reply bytes)
nonzero in [1024,16000):  7136  (first at 0x042e)
marker fragments beyond the victim BMC data: 424
[run.2.log]
RECEIVE ok: msg.data_len = 16001 (compcode + 16000 reply bytes)
nonzero in [1024,16000):  7144  (first at 0x042e)
marker fragments beyond the victim BMC data: 424
[run.3.log]
RECEIVE ok: msg.data_len = 16001 (compcode + 16000 reply bytes)
nonzero in [1024,16000):  7136  (first at 0x042e)
marker fragments beyond the victim BMC data: 424

— control (legal 200-byte reply):
nonzero in [1024,200):  0  (first at 0xffffffff)
marker fragments beyond the victim BMC data: 0