### uname
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
### selftest
selftest: is_sorted(unsorted)=1 (want 1) is_sorted(sorted)=0 (want 0)
rc=0
### fuzz (differential vs libc: verbatim + f6 + f67 + kqsort_r)
FUZZ OK: 8000 iterations (verbatim+f6+f67+kqsort_r vs libc), 0 diff, 0 canary corrupt, 0 OOB/unaligned comparator args
worst cmp-count ratio ~ 507/234 = 2.17 x n*log2(n)
rc=0
### fuzz_lie (inconsistent comparators, memory-safety only)
FUZZ_LIE OK: 2000 iterations x 6 inconsistent comparators (rng/always+1/always-1/all-equal/antisym-intrans/prng): 0 canary corrupt, 0 OOB comparator args (partition+insertion stay in-bounds under any comparator)
rc=0
### truncate (2.16e9-byte partition -> int truncation + unsigned promotion -> OOB partition state; A/B)
small control n=720000: verbatim == libc-reference, calls=11660902
TRUNCATION OOB CONFIRMED: comparator called with args past the array end (x-base=7894967296 y-base=7628096384, n*es=5760000000). Mechanism: byte distance 2,160,000,000 truncates to int -2,134,967,296; 'if ((r = pd - pc) > es)' promotes r (int) to size_t vs es -> huge -> guard PASSES; 'a = pn - r' lands 2134967296 bytes PAST the array end and 'n = r / es' becomes ~2^64 -> next partition compares/swaps wildly out of bounds.
small control n=720000: verbatim == libc-reference, calls=11660902
VERBATIM run: comparator received OOB args (exit 9)
PATCHED(f6): n=720000000 es=8 bytes=5760000000 cmp_calls=8795877536 time=222.4s
  patched: array IS SORTED
truncate verdict: verbatim OOB=1 patched sorted=1
TRUNCATION CONFIRMED (OOB partition state on verbatim; correct sort on patched)
rc=9 (expect 9 = OOB partition state confirmed)
### med3_oob (>=16GiB VA: d=(n/8)*es int overflow -> OOB comparator args)
OOB COMPARATOR ARGS CONFIRMED: x=0x800a00000 (x-base=0) y=0x780c66580 (y-base=-2144967296) base=0x800a00000 n*es=17200000000
rc=3 (expect 3 = OOB args confirmed)
### med3_oob_fixed (patched: no OOB args in first 1000 cmps)
PATCHED(f6): n=17200000000 es=1 bytes=17200000000 (predicted d=(n/8)*es=2150000000 -> int d=-2144967296)
PATCHED med3: 0 OOB comparator args in first 1000 calls (aborting before full 17GiB sort) (calls=1000)
rc=0 (expect 0)
### es0_contrast
rc=0 (expect 0)
### es0_hang (verbatim es=0 n=64: non-termination)
ES0 HANG CONFIRMED: comparator called 5,000,000 times with es=0 (pb frozen at +0; a correct 64-element sort needs <3000) (calls=5000000)
rc=7 (expect 7)
### es0_segv (verbatim es=0 n=7: 8-byte access at zero-length array base)
ES0 ACCESS CONFIRMED (verbatim): SIGSEGV inside kqsort with es=0 n=7 (8-byte self-swap load at base of a zero-length array)
rc=0 (expect 0 = SIGSEGV confirmed)
### es0_segv_fixed (guarded f67: clean return)
es0_segv(1): child exited st=0 (no fault)
rc=0 (expect 0)
OVERALL: ALL_EXPECTATIONS_MET