== DF-5629 baseline (vulnerable kernel #0) — decisive run ==
guest# sh /tmp/df5629/run_guest.sh (size-matrix probe, 8 execs per size, as maxx):
size=20  hits=0/8 total_extra_bytes=0
size=32  hits=6/8 total_extra_bytes=24
size=48  hits=7/8 total_extra_bytes=28
size=64  hits=0/8 total_extra_bytes=0
size=96  hits=0/8 total_extra_bytes=0
size=128 hits=0/8 total_extra_bytes=0
size=256 hits=3/8 total_extra_bytes=12
size=512 hits=0/8 total_extra_bytes=0
size=1000 hits=8/8 total_extra_bytes=184
size=1024 hits=0/8 total_extra_bytes=0

guest# final 3 samples (payload=1000, as maxx, under script(1) pty):
final sample 1: payload(1024)+extra=1024  extra=23 bytes past kmalloc chunk
final sample 2: payload(1024)+extra=1024  extra=23 bytes past kmalloc chunk
final sample 3: payload(1024)+extra=1024  extra=23 bytes past kmalloc chunk
--- leaked tail sample 1 (payload end .. 48 bytes past) ---
       41 41 41 41 74 6d 70 2f 64 66 35 36 32 39 2f 6d    |AAAAtmp/df5629/m|
       61 6b 65 5f 69 6e 74 65 72 70 32 20 6e 6f 74 20    |ake_interp2 not |
--- run 2 ---
       41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
       2f 74 6d 70 2f 64 66 35 36 32 39 20 6e 6f 74 20    |/tmp/df5629 not |
--- run 3 ---
       41 41 41 41 74 6d 70 2f 64 66 35 36 32 39 2f 6d
       2f 74 6d 70 2f 64 66 35 36 32 39 20 6e 6f 74 20

(earlier ungroomed 1024-payload run leaked 2 bytes of kernel heap: ff ff)

== DF-5629 fix validation (patched kernel #1, fix.diff applied) ==
guest# ./make_interp2 final.bin 1000 128; su -m maxx -c 'script -q fixtty.txt ./run_leak ./final.bin 1'
leak-lines=0 (expect 0)                      # tty transcript contains NO "ELF interpreter" line
guest# su -m maxx -c /tmp/df5629/final.bin
/tmp/df5629/final.bin: Exec format error. Binary file not executed.  # ENOEXEC — unterminated PT_INTERP rejected
direct exec rc=1