[CAMQTEST] loaded (production camq_* primitives)
[CAMQTEST] T1 before resize: entries=4 array_size=4
[CAMQTEST] T1 calling camq_resize(&q, 3) with entries=4 (xpt_remove_periph shape)...
[CAMQTEST] T1 after resize: entries=4 array_size=3 (INVARIANT VIOLATED: entries > array_size; no panic, no DIAGNOSTIC guard on stock kernel)
[CAMQTEST] T1 OOB READ via CAMQ_GET_HEAD path: queue_array[4]=0xfffff8008d403420 (past 3-ptr array)
[CAMQTEST] T1 remove head -> 0xfffff8008d40b300 (entries now 3)
[CAMQTEST] T1 remove head -> 0xfffff8008d401b90 (entries now 2)
[CAMQTEST] T1 remove head -> 0xfffff8008d402b60 (entries now 1)
[CAMQTEST] T1 remove head -> 0xfffff8008d403420 (entries now 0)
[CAMQTEST] T1 done (no panic: corruption is silent)
[CAMQTEST] T2 before: entries=6 array_size=6
[CAMQTEST] T2 camq_resize(&q, 4) with entries=6: bcopy(6*8=48) into 4*8=32 buffer
[CAMQTEST] T2 after: entries=6 array_size=4
[CAMQTEST] T2: canary 63 (0xfffff8008d482f40) CORRUPTED at +0: e0 (was a5)
[CAMQTEST] T2: 1 CANARY(IES) OVERWRITTEN -> heap OOB WRITE proven
[CAMQTEST] T3 inserting 5th entry into 4-capacity queue (guard is DIAGNOSTIC-only)...
[CAMQTEST] T3 after: entries=5 array_size=4 (wrote queue_array[5] == 0xfffff8008d2e51c0 PAST the array)
[CAMQTEST] T3: canary 63 (0xfffff8008d942820) CORRUPTED at +0: d0 (was a5)
[CAMQTEST] T3: 1 CANARY(IES) OVERWRITTEN -> heap OOB WRITE proven