=== DF-5378 fix validation (fix.diff applied to guest /usr/src, harness rebuilt against fixed sources) ===
--- mode 1 at kldload (fixed destroy_ctrl takes ctrl lock; old-ordering simulation still shows the primitive, as designed) ---
HARNESS: loaded (real uvc sources compiled in)
HARNESS: graph: ctrl=0xfffff801173c8a08 node=0xfffff8008d7a07b0 controls=0xfffff801171c60a0 controls_num=2 ctrl0(AE)=0xfffff801171c60a0 sub=0xfffff8011738a108 menu=0xfffff8008d7a09f0 | ctrl1(PT)=0xfffff801171c6158 sub0=0xfffff8011738a160 sub1=0xfffff8011738a1b8
HARNESS DF-5378[baseline]: ret=0 name=<Tilt (Absolute)> (expect 0 / 'Tilt (Absolute)')
HARNESS DF-5378: snapshotted 11 chunks in production free order (sub_AE, menu, uvcdata_AE, subP0, subP1, uvcdata_PT, mask, node_info, controls[2], node, ctrl)
HARNESS DF-5378: production uvc_drv_destroy_ctrl() done - graph freed, video->ctrl=0xfffff801173c8a08 now DANGLING (cdev not yet destroyed)
HARNESS DF-5378: all 11 freed chunks reclaimed at their original addresses
HARNESS DF-5378: poisoned reclaimed chunks: PT.sub1->v4l2_name=0x5A*32, AE.sub->v4l2_name=0x5B*32, controls[1].cached_sub_info_idx=0xAA (offset 152)
HARNESS DF-5378[UAF query]: ret=0 name_len=31
HARNESS q.name (user-visible via VIDIOC_QUERYCTRL):
  5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a
  5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 00
HARNESS DF-5378: *** UAF READ/LEAK CONFIRMED: 31 bytes of attacker-marked FREED-chunk content copied into the user-visible queryctrl.name ***
HARNESS DF-5378: *** UAF WRITE CONFIRMED: uvc_ctrls.c:1065 wrote cached_sub_info_idx=1 into the freed-and-reclaimed controls[1] chunk (was 0xAA) ***
HARNESS DF-5378[UAF menu]: ret=0
HARNESS qm.name (user-visible via VIDIOC_QUERYMENU):
  5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b
  5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 5b 00
HARNESS DF-5378: *** QUERYMENU disclosure confirmed (strlcpy from freed sub_info at uvc_ctrls.c:1150) ***
HARNESS LEAKSAMPLE-QUERYCTRL 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a00
HARNESS LEAKSAMPLE-QUERYMENU 5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b00
HARNESS DF-5378: mode 1 done, guest should stay up
HARNESS: graph: ctrl=0xfffff8008fa26de8 node=0xfffff8008d640600 controls=0xfffff80116f944a0 controls_num=2 ctrl0(AE)=0xfffff80116f944a0 sub=0xfffff80117c115e8 menu=0xfffff8008d640690 | ctrl1(PT)=0xfffff80116f94558 sub0=0xfffff80117c11640 sub1=0xfffff80117c11698
HARNESS DF-5378[fix baseline]: ret=0 name=<Tilt (Absolute)>
HARNESS DF-5378[fix post-detach]: query ret=19 (want ENODEV=19, NO freed-memory access, guest up)
--- mode 3: fixed-detach simulation (production fixed uvc_query_v4l2_ctrl guard) ---
HARNESS: graph: ctrl=0xfffff8008fa26de8 node=0xfffff8008d640600 controls=0xfffff80116f944a0 controls_num=2 ctrl0(AE)=0xfffff80116f944a0 sub=0xfffff80117c115e8 menu=0xfffff8008d640690 | ctrl1(PT)=0xfffff80116f94558 sub0=0xfffff80117c11640 sub1=0xfffff80117c11698
HARNESS DF-5378[fix baseline]: ret=0 name=<Tilt (Absolute)>
HARNESS DF-5378[fix post-detach]: query ret=19 (want ENODEV=19, NO freed-memory access, guest up)

guest alive:  7:21PM  up 48 secs, 0 users, load averages: 0.22, 0.07, 0.02