6718 /root/df4924_trigger.c
BUILD_OK
== baseline accounting (tree as-is: TMZ NOT in emit_frame_size) ==
frame_size=160 emit_ib_size=4 align_mask=0xff tmz=+2 dw
num_ibs= 24 reserved= 256 emitted= 258 writes_past_count=2 canary_dwords_destroyed=2
num_ibs= 88 reserved= 512 emitted= 514 writes_past_count=2 canary_dwords_destroyed=2
num_ibs=152 reserved= 768 emitted= 770 writes_past_count=2 canary_dwords_destroyed=2
baseline: 3 overrun submission(s) in num_ibs 1..200: 24 88 152 
rule: reserved = ALIGN(160 + 4*n, 256); emitted = 160 + 4*n + 2
      overrun iff (160 + 4*n) % 256 == 0 iff n % 64 == 24
== fixed accounting (emit_frame_size += 2 for TMZ) ==
fixed: 0 overrun submission(s) in num_ibs 1..200 (expect 0)
VERDICT: baseline overruns by exactly 2 dwords iff num_ibs % 64 == 24; fix eliminates all. REPLICATED.