== PATCHED ppbconf.c (fix.diff applied in guest /usr/src), fresh-boot run (fixrun2) ==
PPBX2: --- DF-5510 search_token(class, len) length confusion ---
PPBX2: DF-5510 Ta in-bounds cross-field: ID "CLS:QQ;CMD:PRINTER;" class_value=QQ -> class_id=10 (UNKNOWN)  [correct: 10 UNKNOWN; buggy: 0 PRINTER]
PPBX2: DF-5510 Tb OOB: 256-byte ID, CLS: at 248, class=str+252, scan window str[252..507] (251 bytes past the 257-byte str[] object); stack pre-dirtied with class tokens
PPBX2: DF-5510 Tb OOB result: class_id=10 (UNKNOWN)  [correct: 10 UNKNOWN; any 0..9 = token matched in uninitialized/out-of-bounds stack bytes]
PPBX2: Tb dirt-survival map below sp=0xfffff80118257977: PRINTER@-1634 PORTS@-1615 MODEM@-164 NET@-1579 FDC@-1660
PPBX2: DF-5510 Tc control (short ID, same dirt): class_id=10 (UNKNOWN) [expect 10 UNKNOWN]

== second patched run (fixrun1) gave identical results ==