UPROBE case1(control): strlen(scratch)=25 scratch=255 bytes_past_boundary=0 desc[0..25]="Generic USB interface hub" desc[255..290]=""
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="M-~^C-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
UPROBE case1(control): strlen(scratch)=25 scratch=255 bytes_past_boundary=0 desc[0..25]="Generic USB interface hub" desc[255..290]=""
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="M-~^C-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
UPROBE case1(control): strlen(scratch)=25 scratch=255 bytes_past_boundary=0 desc[0..25]="Generic USB interface hub" desc[255..290]=""
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="M-~^C-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
UPROBE case1(control): strlen(scratch)=25 scratch=255 bytes_past_boundary=0 desc[0..25]="Generic USB interface hub" desc[255..290]=""
UPROBE case1(RACED): strlen(scratch)=1023 scratch=255 bytes_past_boundary=769 desc[0..25]="M-~^C-N-N-N-N-N-N-N-N-N-N-N-" desc[255..290]="ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"

(dmesg tail across initial + 3 stress invocations of
 `sysctl hw.usutil_probe=1` — 4 raced runs total, all identical:
 control always 25 bytes / 0 past boundary; raced always 1023 / 769 past,
 adjacent-heap marker bytes 0x5A ('Z') captured past the scratch boundary)