==== FIX VALIDATION — guest kernel built from /usr/src with fix.diff (8 hunks) ====
kernel: DragonFly 6.5-DEVELOPMENT #1: Fri Oct  2 00:11:04 UTC 2026

---- userspace verbatim harness (re-extracted from PATCHED tree) ----
== t4 ==
t4: ident="TEST" rocnt=1 ros[0]="NA"->"X" (parse OK, harness faithful)
exit=0
== t2 ==
t2: stage1 parse...
pci0:2:3:1: bad keyword length: 0
t2: stage1 done
t2: post-parse cfg.vpd state:
t2:   vpd_ros  = 0x0   (freed and NULLed by cleanup)
t2:   vpd_rocnt= 0   (STALE -- cleanup does not reset it)
t2:   vpd_ident= 0x0
t2:   vpd_w    = 0x0, vpd_wcnt = 0
t2: stage2a parse (valid NA keyword + End)...
t2: stage2a done
t2: vpd_ros[0] = {"NA", "X"}; lookup("NA") -> ret=0 vptr=0x8004b4000
t2: lookup OK
t2: stage2b parse (section completes, then device stops)...
pci0:4:5:6: failed to read VPD data.
t2: stage2b: vpd_ros=0x0 vpd_rocnt=0 -- now calling the verbatim lookup on this state:
t2: BUG: lookup returned 6 vptr=0xffffffffffffffff without crashing
exit=0
== t2a ==
pci0:2:3:1: invalid VPD data, remain 0x500
t2a: remain=0x500 exceeded the 0x7f*4 bound; the kernel
t2a: printed "invalid VPD data" but then CONTINUED:
t2a:   vpd_ident NULL (parse aborted -- fixed kernel)
exit=0
== t3 ==
t3: malicious device serves an endless keyword stream;
t3: capping it at 20000 bytes (guest VA limits the demo; a real device never stops).
t3: parser stopped ONLY because the simulator capped the
t3: device at 20000 bytes (vrs.off=4, config reads=4).
t3: allocations during the capped run: 2 kmalloc/krealloc, 130 bytes, largest 128 bytes
t3: state machine had not terminated: every keyword kept
t3: consuming bytes with remain<0; with an uncapped device the
t3: loop and the allocations grow without bound.
exit=0
== t1 ==
t1: launching verbatim pci_read_vpd(): String item length 0
t1: parser does kmalloc(remain+1) == kmalloc(1), then state 1
t1: writes one payload byte per VPD byte with no bound...
t1: returned; vpd_ident==NULL (parser rejected the zero-length item -- fixed kernel)
exit=0

---- kernel modules against PATCHED kernel ----
DF5276: running verbatim pci_read_vpd() with a zero-length identifier item
DF5276: parser never allocated vpd_ident (item rejected -- fixed kernel)
DF5277(A): pci_freecfg() with all VPD pointers NULL, vpd_reg=0x40 (never parsed)
DF5277: pci_freecfg() returned without crashing (fixed kernel)
DF5277(B): pci_freecfg() with vpd_ros=NULL, vpd_rocnt=1 (stale after error cleanup)
DF5277: pci_freecfg() returned without crashing (fixed kernel)