== domain constants (gpio_types.h) ==
GPIO_DDC_LINE_DDC1=0 DDC6=5 DDC_VGA=6 I2C_PAD(==VIP_PAD)=7 COUNT=8
GPIO_ENUM_UNKNOWN=32 GPIO_GPIO_PAD_MAX=30
consumer arrays: hpd_regs[6] ddc_data_regs[8] (hw_factory_dce80.c)

== T1: DDC/VGA/I2CPAD offsets return success WITHOUT writing *id ==
(dal_gpio_service_create_irq gpio_service.c:148 declares 'enum gpio_id id;' uninitialized)
offset_to_id(mmDC_GPIO_DDCVGA_A,0x100) = true en=6(id==(other))
  -> BUG(DF-4943): success returned, *id NEVER WRITTEN; consumer switches on uninitialized id
offset_to_id(mmDC_GPIO_I2CPAD_A,0x1)  = true en=7(id==(other))
offset_to_id(mmDC_GPIO_DDC1_A,0x100)  = true en=0(id==(other))

== T2: GPIOPAD offset succeeds with en up to 30 (DF-4942 producer) ==
(dal_gpio_create_ddc ignores id and feeds en to ddc_data_regs[8])
offset_to_id(mmGPIOPAD_A,1<<20) = true id=GPIO_ID_GPIO_PAD(4) en=20
  -> BUG(DF-4942): success with en=20 >= 8 entries: define_ddc_registers reads ddc_data_regs[20] OOB (hw_factory_dce80.c:122), regs then drive MMIO
offset_to_id(mmGPIOPAD_A,1<<7)  = true en=7 (in-bounds, no OOB)

== T3 (negative): GPIOPAD en bound inside offset_to_id is sound ==
offset_to_id(mmGPIOPAD_A,1<<31) = false en=31 (31>30 rejected: OK)
    [BREAK_TO_DEBUGGER hit]
offset_to_id(mmGPIOPAD_A,0x3)   = false en=32 (multi-bit->UNKNOWN=32 rejected: OK)
    [BREAK_TO_DEBUGGER hit]
offset_to_id(mmGPIOPAD_A,0x0)   = false en=32 (zero->UNKNOWN=32 rejected: OK)

== T4: id_to_offset GPIO_PAD compares MASK vs INDEX (DF-4944) ==
id_to_offset(GPIO_PAD,en=5)  = false mask=0x20 (pad 5 is VALID per enum but rejected: 1<<5=32 > 30)
id_to_offset(GPIO_PAD,en=30) = false mask=0x40000000 (pad 30 VALID, rejected)
id_to_offset(GPIO_PAD,en=32) = true mask=0x0 (en=32 is INVALID; UB shift 1<<32 -> mask=1 <= 30 -> ACCEPTED with wrong mask)
id_to_offset(GPIO_PAD,en=64) = true mask=0x0 (invalid, also accepted via UB)

== T5 (negative): HPD id_to_offset rejects en>=6 ==
id_to_offset(HPD,en=5) = true (OK)
    [BREAK_TO_DEBUGGER hit]
id_to_offset(HPD,en=6) = false (rejected: OK — only the uninit-id path can smuggle en>=6 into hpd_regs)

4 contract-violation reproductions (T1/T2/T4 classes)
RUN_EXIT=0