=== DF-4948 FIX-VALIDATED run (fix.diff applied to guest /usr/src, nativekernel rebuilt+installed, rebooted) ===
--- producer: verbatim smic_polled_request recompiled from the PATCHED source ---
DragonFly 6.5-DEVELOPMENT #1: Fri Sep 25 08:44:00 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC 
  recv.msg.data_len = sizeof(scratch);
BUILD-OK
smicshock: smic_polled_request() = 1
smicshock: BMC streamed 16000 reply data bytes
smicshock: req->ir_replylen   = 1024
smicshock: req->ir_replybuflen = 1024
smicshock: clamped (ir_replylen <= ir_replybuflen): fix present at ipmi_smic.c:341
fds: victim=3 markers=4 pid=1009 uid=1001
groom: 30 patterned chunks allocated, 20 freed (rest held live)
marker+victim sends done; waiting for hw.bumpreplylen=16000 ...
armed: 16000
RECEIVE ok: msg.data_len = 1025 (compcode + 1024 reply bytes)
nonzero in [0,1024):     1
nonzero in [1024,1024):  0  (first at 0xffffffff)
block census (offset:nonzero/1024):
      0:    1
marker fragments beyond the victim BMC data: 0
reply head (BMC data) [0x0000]:
  0000: c6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
  0010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
  0020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

--- sink: same bumpko arming (ir_replylen=16000) through the patched ipmi.c consumer ---
RECEIVE ok: msg.data_len = 1025 (compcode + 1024 reply bytes)
nonzero in [0,1024): 1
nonzero in [1024,1024): 0
marker fragments beyond the victim BMC data: 0
-> over-read ELIMINATED; IPMI device still functional (the SEND/RECEIVE round
   trips of the leak program itself succeed on the patched kernel).