=== DF-5719 evidence suite Sat Oct 10 15:23:57 UTC 2026 ===
--- uname ---
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
--- rig1 SIZE ---
sizeof(bcd2bin_data) = 154 (max valid BCD index 0x99=153)
sizeof(bin2bcd_data) = 100 (max valid bin index 99)
sizeof(hex2ascii_data) = 37
=> any macro index above 100/153 is out of bounds
--- rig3 DIFF ---
bin2bcd vs arithmetic + fix-mask identity, 0..99: MATCH (0 errors)
bcd2bin vs arithmetic + fix-mask identity over valid BCD 0x00..0x99: MATCH (0 errors)
hex2ascii radix[2..36] domain (0..35): MATCH (0 errors)
rc=0
--- rig2 GUARD (verbatim kernel macros) ---
guard-page rig (verbatim kernel macros, objects end at PROT_NONE boundary)
bin2bcd(99)   (last in-bounds) : OK
bin2bcd(100)  (first OOB)      : SIGSEGV
bin2bcd(200)  (ioctl byte)     : SIGSEGV
bin2bcd(255)  (max u_char)     : SIGSEGV
bcd2bin(0x99) (last in-bounds) : OK
bcd2bin(0x9a) (first OOB)      : SIGSEGV
bcd2bin(0xff) (garbage CMOS)   : SIGSEGV
=> verbatim macros index past the end of the objects
--- rig4 FIXED ---
fix.diff treatment under the same guard-page placement:
bin2bcd_fixed(200) : in-bounds (value=0)
bin2bcd_fixed(255) : in-bounds (value=85)
bcd2bin_fixed(0xff): in-bounds (value=65)
=> masked indices never leave the objects
rc=0
--- strlen differential ---
libc differential: 34 cases, 0 mismatches -> IDENTICAL
strlen with NUL as final byte at guard page: value=299 fault=no (expect no fault)
str_harness.c: semantics identical to libc; boundary reads exactly as contracted
--- strnlen differential ---
libc differential: 268 cases, 0 mismatches -> IDENTICAL
strnlen(buf,300) on 300-byte non-NUL buffer at guard: value=300 fault=no (expect 0)
strnlen(buf,301) same buffer            : fault=YES (expect YES -- bound is exactly maxlen, this is the caller contract, not an implementation over-read)
strnlen(buf,0)                          : value=0 fault=no (expect 0/no)
str_harness.c: semantics identical to libc; boundary reads exactly as contracted