DF-5676 evidence battery (guest, root) — consolidated from the live runs
=========================================================================

$ cd /tmp/df5676 && sh run.sh            [first run — original kernel boot]
DF5676 probe sentinel  (2 bytes + NUL as last byte of page): prop_array_internalize...
Segmentation fault (core dumped)
df5676 exit=139 (139=SIGSEGV => overread realized)

=== codegen: how MATCH() compiled in the rig (calls = libc memcmp) ===
     ad3:	81 7b 01 3f 78 6d 6c 	cmpl   $0x6c6d783f,0x1(%rbx)   <-- gcc-widened 4-byte load of "?xml" at xml+1
     aed:	81 7b 01 3c 21 2d 2d 	cmpl   $0x2d2d213c,0x1(%rbx)   <-- widened "<!-" (find_tag <!-- check, same class)

=== same function inside the RUNNING kernel binary ===
ffffffff809e1510 T _prop_object_internalize_context_alloc
ffffffff809e1577:	callq  ffffffff80bcb800 <bcmp>      (MATCH("?xml "))
ffffffff809e158f:	callq  ffffffff80bcb800 <bcmp>      (MATCH("!DOCTYPE plist"))
[kernel bcmp = sys/libkern/bcmp.c: byte-wise until 8-aligned (stops at the
sentinel on mismatch), then aligned 8-byte loads that cannot cross a page;
result masked to the significant bytes -> page-contained read, no fault, no leak]

-------------------------------------------------------------------------
$ fix validation (same-source rig, fix.diff applied)  [after DF-5675 fix kernel boot]
== baseline (expect SIGSEGV) ==
DF5676 probe sentinel  (2 bytes + NUL as last byte of page): prop_array_internalize...
Segmentation fault (core dumped)
base exit=139

== fixed (expect no fault) ==
DF5676 probe sentinel  (2 bytes + NUL as last byte of page): prop_array_internalize...
DF5676 probe sentinel : returned, NO fault (memcmp stopped at sentinel / byte-wise inlined)
DF5676 probe prefix5   (6 bytes + NUL as last byte of page): prop_array_internalize...
DF5676 probe prefix5  : returned, NO fault (memcmp stopped at sentinel / byte-wise inlined)
DF5676 probe prefix9   (10 bytes + NUL as last byte of page): prop_array_internalize...
DF5676 probe prefix9  : returned, NO fault (memcmp stopped at sentinel / byte-wise inlined)
no fault observed
fix exit=0