# DF-5378 raw disclosed bytes (32 bytes of each user-visible name field),
# baseline run (guest 1), mode 1: freed sub_info chunks reclaimed and filled
# with attacker markers (0x5A / 0x5B), then read out through the production
# VIDIOC_QUERYCTRL / VIDIOC_QUERYMENU handlers:
HARNESS LEAKSAMPLE-QUERYCTRL 5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a00
HARNESS LEAKSAMPLE-QUERYMENU 5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b5b00
# In a real attack the markers stand for whatever content the attacker (or
# any other kernel subsystem sharing the M_UVC size-class zone) placed in
# the freed chunks between uvc_drv_destroy_ctrl() and the in-flight ioctl:
# 31 bytes of kernel heap per query, repeatable at will.