# DF-5543 — uep(4) stashes the wrong byte (`buf[0]` instead of the remaining `p[0]`) when a transfer ends one byte after completing a reassembled packet

## What this is

Evidence pack for the pass-2 finding against `sys/bus/u4b/input/uep.c`.
Same production-code KLD harness as DF-5542 (see that README for the
methodology): the unmodified production `uep.c` is compiled into
`ueph.ko`, synthetic interrupt transfers drive the real
`uep_intr_callback()`, and the real `uep_put_queue()` records are captured.

## Build / run

Identical to DF-5542 (`build.sh`, `run.sh` in this directory).

## Expected output (stock kernel source — the bug)

    UEPH: T3 stash queued_reports=1 report0=81:bb:cc:dd:ee aa_dropped=1 verdict=WRONG_BYTE_STASHED
    UEPH: T4 cascade queued_reports=0 queued_bytes=0 buf_len=1 verdict=PERMANENT_STALL

- **T3** (this finding): the device sends a 6-byte PRESSURE-class packet
  split as 5 bytes + 2 bytes, the 2-byte transfer being `{0x81, 0xAA}` —
  `0x81` completes the pressure packet, `0xAA` is the one byte remaining in
  the transfer. The stash at uep.c:236 stores `buf[0]` (the *already
  consumed* `0x81`) instead of `p[0]` (the *remaining* `0xAA`). The next
  4-byte transfer then reassembles and queues the **fabricated report
  `81 bb cc dd ee`** (phantom touch coordinates; the true stream byte
  `0xAA` never appears anywhere in the vendored stream).
- **T4**: same setup with the consumed byte being `0x55` — a bad header —
  which arms DF-5542's permanent stall (mis-stash -> wedge cascade).

## Fix validation

`fix.diff` hunk 2 changes the stash to `p[0]`. Patched run
(`fix_run.log`): T3 `queued_reports=0 ... verdict=correct` — no fabricated
report; the true remaining byte `0xAA` is now what gets stashed and parsed
(its length-class assembles a 5-byte candidate which the format check
correctly rejects, i.e. proper header-resync instead of phantom input);
T4 `no_stall` with 13 reports aligned to the true stream.

## Files

Same layout as DF-5542 (shared harness): `uep_harness.c`, `Makefile`,
`build.sh`, `run.sh`, `build.log`, `run.log`, `run.2.log`,
`fix_build.log`, `fix_run.log`, `env.txt`, `fix.diff`, `manifest.json`,
`verdict.json`.