# DF-5360 — Poisoned num_iospace=16/num_memspace=8 persist on queued cfe after CFTABLE error-break (latent heap-OOB consumer)

File: sys/bus/pccard/pccard_cis.c (pass 2, GLM 5.3).  Full narrative: VERDICT.md.

## Reproduce (deterministic userland model of the kernel parse/consume chains)
    ./build.sh                 # cc -O2 -Wall -o poc_pccard_cis2 poc_pccard_cis2.c
    ./run.sh                   # ./poc_pccard_cis2 poison

Expected decisive output: the `RESULT: DF-5360 ...` line (see run.log; exit 0).
Built and executed on the DragonFly guest toolchain (DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT),
cc 8.3. The QEMU guest has no PCMCIA bridge, so the kernel path itself is not
enterable; the model mirrors pccard_cis.c:100-444 (walk), :612-1260 (handlers),
decode_funce :1262-1294 and the pccard.c:429-474 consumer loops statement-by-
statement. Run `./poc_pccard_cis2 all` for every scenario incl. negatives.

What it proves: card.error gate (pccard.c:204) blocks today's consumers; counts > array persist and propagate via the :914 default copy.
Recommended fix: Zero cfe->num_iospace / cfe->num_memspace on the 'too many spaces' error paths (:1054/:1174) (fix.diff).