DF-5305 leak samples: fmt->name[0..63] (hex) across the 3 baseline rounds.
blob = 72-byte cdesc allocation; in-bounds non-NUL run = 27 bytes
(16 GUID 0xC1..0xD0 + 7 x 0x55 + 4 x 0x5A).  Everything after byte 27
was read from OUTSIDE the allocation; the adjacent heap chunk was
groomed with the per-round marker (0x43 / 0x45 / 0x47).

--- round 1 (marker 0x43) ---
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 43 43 43 43 43
  43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 43
  43 43 43 43 43 43 43 43 43 43 43 43 43 43 43 00
  strlen=63 -> 36 bytes leaked from beyond the allocation

--- round 2 (marker 0x45) ---
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 45 45 45 45 45
  45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 45
  45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 00
  strlen=63 -> 36 bytes leaked from beyond the allocation

--- round 3 (marker 0x47) ---
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  55 55 55 55 55 55 55 5a 5a 5a 5a 47 47 47 47 47
  47 47 47 47 47 47 47 47 47 47 47 47 47 47 47 47
  47 47 47 47 47 47 47 47 47 47 47 47 47 47 47 00
  strlen=63 -> 36 bytes leaked from beyond the allocation

--- post-fix (fix.diff applied), rounds 1-3 ---
  c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf d0
  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  ... (all zero)
  strlen=16 -> copy bounded to the 16 GUID bytes, no OOB read

User-visible VIDIOC_ENUM_FMT description baseline round 1:
  <C1C2...D0 UUUUUUU ZZZZ CCCC>  (final CCCC = leaked heap marker bytes)