== negative: shipped-table shape (func0,func1), no alloc failure
  neg live pf#0 ccr_base=0x800 cfe: #7
  neg live pf#1 ccr_base=0x900 cfe: #39
  freed-memory audit[negative]: CLEAN (0 writes into kfree'd blocks)
== shippedfail: shipped-table shape, cfe alloc of quirk#2 fails (fail_nth=10)
RIG: kmalloc call #10 (160 bytes) -> NULL (failpoint)
no memory for quirk (2)
  shipped live pf#0 ccr_base=0x800 cfe: #7
  freed-memory audit[shippedfail]: CLEAN (0 writes into kfree'd blocks)
  (expected: CLEAN -- with the shipped 2-entry shape the loop ends after the failure; fast path never runs)
== repeat: 3-entry table re-using func0 template, quirk#2 cfe alloc fails (fail_nth=10)
RIG: kmalloc call #10 (160 bytes) -> NULL (failpoint)
no memory for quirk (2)
  repeat live pf#0 ccr_base=0x800 cfe: #7
  FREED-WRITE[repeat]: block 0x800493000 (kmalloc #9) modified: first diff at +41, 5 byte(s) changed (snapshot 0x00 -> 0x42)
  offsetof(struct pccard_function, cfe_head) = 40 (STAILQ_INSERT_TAIL writes sqh_first at +0 and sqh_last at +8 of cfe_head)
RESULT: DF-5585 repeat: quirk#3 fast path (pf_last==q->pf) STAILQ_INSERT_TAIL'd a cfe into the pf kfree'd at pccard_cis_quirks.c:282 -> write-after-free
== fixed_repeat: 3-entry table re-using func0 template, quirk#2 cfe alloc fails (fail_nth=10)
RIG: kmalloc call #10 (160 bytes) -> NULL (failpoint)
no memory for quirk (2)
  fixed live pf#0 ccr_base=0x800 cfe: #7
  fixed live pf#0 ccr_base=0x800 cfe: #7
  freed-memory audit[fixed_repeat]: CLEAN (0 writes into kfree'd blocks)
  offsetof(struct pccard_function, cfe_head) = 40 (STAILQ_INSERT_TAIL writes sqh_first at +0 and sqh_last at +8 of cfe_head)
RESULT: DF-5585 fixed_repeat: pf_last=NULL guard keeps the invariant; no freed-memory writes
== nulltemplate: entry with pf==NULL; the wipe loop (:248-257) always exits with pf==NULL (it is the loop variable), so pf_last==NULL==q->pf takes the fast path and INSERT_TAIL dereferences &pf->cfe_head == 0x28
  child died on SIGSEGV writing near address 0x28/0x30 -- the kernel equivalent is a NULL-page write (deterministic panic)
RESULT: DF-5585 nulltemplate: NULL pf template + pf_last(NULL)==q->pf fast path -> &pf->cfe_head deref at offset 40 of NULL
== fixed_nulltemplate: entry with pf==NULL; the wipe loop (:248-257) always exits with pf==NULL (it is the loop variable), so pf_last==NULL==q->pf takes the fast path and INSERT_TAIL dereferences &pf->cfe_head == 0x28
  fixed live pf#0 ccr_base=0x0 cfe: #0 #1
  fixed live pf#1 ccr_base=0x0 cfe: #0 #1
  freed-memory audit[fixed_nulltemplate]: CLEAN (0 writes into kfree'd blocks)
RESULT: DF-5585 fixed_nulltemplate: NULL-template guard skips the entry; no freed-memory writes, no fault
== matchmatrix: every card identity the SHIPPED 8-entry table can match
  card 3COM 3CXEM556      -> matches: [0:pf=xemf0] [1:pf=xemf1]  (set size 2)
  card 3COM 3CXEM556INT   -> matches: [2:pf=xemf0] [3:pf=xemf1]  (set size 2)
  card 3COM 3CCFEM556BI   -> matches: [4:pf=bif0] [5:pf=bif1]  (set size 2)
  card SVEC LANCARD       -> matches: [6:pf=svec]  (set size 1)
  card NDC ND5100_E       -> matches: [7:pf=ndc]  (set size 1)
  card no-match card      -> matches: none  (set size 0)
RESULT: DF-5585 matchmatrix: shipped table fast-path reachable by ANY card identity: NO (match sets <= 2 entries, templates within a set always differ)
DF-5585 rig done (all): freed-write findings=2
rc=1