T1 guard theorem : cases=60800 violations=0 (expected 0)
T2 differential  : cases=48640 match=24384 dev_sepnull(DF-2253 class)=12160 dev_trunc_granularity=12096 dev_other=0 (expected 0)
T3 HEX_NCPYLEN argument is unparenthesized (sys/sys/libkern.h:67):
   #define HEX_NCPYLEN(s)  (s * 3)
   HEX_NCPYLEN(NBYTES+1), NBYTES=8 -> sizeof array = 11 (need 27)
   HEX_NCPYLEN_FIXED(NBYTES+1)      -> sizeof array = 27
   runtime: n=8  HEX_NCPYLEN(n+1)=11  HEX_NCPYLEN_FIXED(n+1)=27
   hexncpy(9 bytes, outlen=27, ":") into the 11-byte macro-sized buffer:
      string produced   : 'de:ad:be:ef:13:37:c0:0d:42'
      guard bytes smashed past the 11-byte buffer: 16 (true footprint = 27 bytes)
T3 RESULT: LATENT OVERFLOW DEMONSTRATED (macro sizes 27->11, hexncpy needs 27 bytes at sep!=NULL)
T4 DF-2252 confirmed: inlen=0 wrote NUL at outb[-1] (byte before buffer)
T4 DF-2253 confirmed: sep=NULL, outlen=HEX_NCPYLEN(4)=12 -> '0102030' (final nibble of 04 destroyed)
EXIT=0