-- QUICK scan 0x08..0x7a --
  ACK  0x20
  ACK  0x50
  ACK  0x51
  ACK  0x52
  ACK  0x53
  ACK  0x54
  ACK  0x55
  ACK  0x56
  ACK  0x57
  (9 live slave(s))
-- SSIF Get Device ID (slave 0x20) --
BWRITE cmd=2 (SSIF req)            rc= 0 errno= 0
BREAD  cmd=3 (SSIF rsp)            rc=-1 errno=22 rcount=1024 data=00 00 00 00
-- DF-5458: uninitialized bcount gates SMB_BREAD --
fresh-process BREAD (kernel stack garbage):
  BREAD cmd=3                      rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3                      rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3                      rc=-1 errno=22 rcount=1024 data=00 60 44 00
dirty the kernel stack with unrelated syscalls (write/read of 0x10 bytes):
  BREAD cmd=3 (post-dirty)         rc=-1 errno=22 rcount=1024 data=00 60 44 00
prime the response, then chain reads (previous bcount self-perpetuates):
  BWRITE cmd=2 (SSIF req)          rc= 0 errno= 0
  BREAD cmd=3 (primed)             rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3 (chained)            rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3 (chained)            rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3 (chained)            rc=-1 errno=22 rcount=1024 data=00 60 44 00
DDC read (QEMU clamps count 0xFF->0) resets slot to 0:
  BREAD slave=0x50 cmd=1           rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3 (after 0)            rc=-1 errno=22 rcount=1024 data=00 60 44 00
  BREAD cmd=3 (still 0?)           rc=-1 errno=22 rcount=1024 data=00 60 44 00
  WRITEB slave=0x50 (depth probe)  rc= 0 errno= 0
  BREAD cmd=3 (post WRITEB)        rc=-1 errno=22 rcount=1024 data=00 60 44 00
-- DF-5457 model of smb.c SMB_BREAD epilogue --
block_count(slave)=255  count_in(stale byte)=32
copyout length     = 255
initialized bytes  = 32
stale-stack bytes  = 223 (0xAA pattern reaches userspace)
verified 0xAA in userspace tail: 223 bytes