=== A. assert rig (assertions live — stock INVARIANTS kernel analog) ===
--- df5678_assert control ---
control: set(5) rv=1 count=510 cap=510
control: remove(5) count=509
control: done, no fault
[df5678_assert control] exit=0
--- df5678_assert seteqcnt ---
seteqcnt: set(510) rv=1 count=511 cap=526
seteqcnt: done, no fault
[df5678_assert seteqcnt] exit=0
--- df5678_assert set ---
set: pre  count=510 cap=510, calling set(512)...
Assertion failed: (idx < pa->pa_count), function prop_array_set, file prop_array.c, line 648.
[df5678_assert set] exit=134
--- df5678_assert remove ---
Abort trap (core dumped)
remove: pre  count=510 cap=510, calling remove(600)...
Assertion failed: (idx < pa->pa_count), function prop_array_remove, file prop_array.c, line 701.
[df5678_assert remove] exit=134

=== B. NDEBUG rig (assertions compiled out — non-INVARIANTS kernel analog) ===
--- df5678_ndebug control ---
Abort trap (core dumped)
control: set(5) rv=1 count=510 cap=510
control: remove(5) count=509
control: done, no fault
[df5678_ndebug control] exit=0
--- df5678_ndebug seteqcnt ---
seteqcnt: set(510) rv=1 count=511 cap=526
seteqcnt: done, no fault
[df5678_ndebug seteqcnt] exit=0
--- df5678_ndebug set ---
set: pre  count=510 cap=510, calling set(512)...
SIGSEGV si_addr=0x89736c6162 (guard page after prop_array backing store — OOB access reached)
[df5678_ndebug set] exit=139
--- df5678_ndebug remove ---
remove: pre  count=510 cap=510, calling remove(600)...
SIGSEGV si_addr=0x0 (guard page after prop_array backing store — OOB access reached)
[df5678_ndebug remove] exit=139

=== C. guard rig (NDEBUG + guard pages — precise OOB localization) ===
--- df5678_guard control ---
control: set(5) rv=1 count=510 cap=510
control: remove(5) count=509
control: done, no fault
[df5678_guard control] exit=0
--- df5678_guard seteqcnt ---
seteqcnt: set(510) rv=1 count=511 cap=526
seteqcnt: done, no fault
[df5678_guard seteqcnt] exit=0
--- df5678_guard set ---
set: pre  count=510 cap=510, calling set(512)...
SIGSEGV si_addr=0x8004f3010 (guard page after prop_array backing store — OOB access reached)
[df5678_guard set] exit=139
--- df5678_guard remove ---
remove: pre  count=510 cap=510, calling remove(600)...
SIGSEGV si_addr=0x8004f32d0 (guard page after prop_array backing store — OOB access reached)
[df5678_guard remove] exit=139