[CAMQTEST] T3: canary 63 (0xfffff8008d942820) CORRUPTED at +0: d0 (was a5)
[CAMQTEST] T3: 1 CANARY(IES) OVERWRITTEN -> heap OOB WRITE proven
[CAMQTEST] unloaded
[CAMQTEST] loaded (production camq_* primitives)
[CAMQTEST] T1 before resize: entries=4 array_size=4
[CAMQTEST] T1 calling camq_resize(&q, 3) with entries=4 (xpt_remove_periph shape)...
[CAMQTEST] T1 after resize: entries=4 array_size=4 (INVARIANT VIOLATED: entries > array_size; no panic, no DIAGNOSTIC guard on stock kernel)
[CAMQTEST] T1 OOB READ via CAMQ_GET_HEAD path: queue_array[4]=0xfffff8004f0a2ac0 (past 4-ptr array)
[CAMQTEST] T1 remove head -> 0xfffff8004f0a2a90 (entries now 3)
[CAMQTEST] T1 remove head -> 0xfffff8004f0a2aa0 (entries now 2)
[CAMQTEST] T1 remove head -> 0xfffff8004f0a2ab0 (entries now 1)
[CAMQTEST] T1 remove head -> 0xfffff8004f0a2ac0 (entries now 0)
[CAMQTEST] T1 done (no panic: corruption is silent)
[CAMQTEST] T2 before: entries=6 array_size=6
[CAMQTEST] T2 camq_resize(&q, 4) with entries=6: bcopy(6*8=48) into 4*8=32 buffer
[CAMQTEST] T2 after: entries=6 array_size=6
[CAMQTEST] T2: all 64 canaries intact
[CAMQTEST] T3 inserting 5th entry into 4-capacity queue (guard is DIAGNOSTIC-only)...
[CAMQTEST] T3 after: entries=4 array_size=4 (wrote queue_array[4] == 0xfffff8004f0a2ab0 PAST the array)
[CAMQTEST] T3: all 64 canaries intact