=== S5 poison: counts>array persist after error-break (DF-5360) ===
  scan r=0 iters=4 card.error=2 poison_io=16 poison_mem=8
  live cfe number=1 num_iospace=16 (array 4) num_memspace=0 (array 2)
  GATE: card.error=2 -> pccard_attach_card bails at pccard.c:204-208 TODAY, so the consumer loops below are LATENT; any consumer that trusts the stored counts reads OOB:
  consumer pccard.c:429  i<num_iospace=16 -> 8 OOB element reads, deepest 120 bytes past the 160-byte kmalloc chunk
  consumer pccard.c:452  i<num_memspace=0 -> 0 OOB element reads, deepest 0 bytes past the chunk
  live cfe number=2 num_iospace=16 (array 4) num_memspace=8 (array 2)
  GATE: card.error=2 -> pccard_attach_card bails at pccard.c:204-208 TODAY, so the consumer loops below are LATENT; any consumer that trusts the stored counts reads OOB:
  consumer pccard.c:429  i<num_iospace=16 -> 8 OOB element reads, deepest 120 bytes past the 160-byte kmalloc chunk
  consumer pccard.c:452  i<num_memspace=8 -> 6 OOB element reads, deepest 128 bytes past the chunk
RESULT: DF-5360 counts > array size are stored on the queue-inserted cfe BEFORE validation (:1044/:1164) and the error-break (:1054/:1174) leaves them; the default-copy *cfe = *default_cfe (:914) then propagates them to later entries.