FIX-VALIDATION RUN (kernel #5, fix.diff applied: fwdev.c:532 pay_len bound +
fwdev.c:566 & dropped) -- authoritative observations captured live:

* attack5845.sh 3 (same weapon binary, same rig, same response packets)
* attempt 1: rig ABORT (no S/V on the wire) -- harmless
* attempts 2-3: rig verified S/V geometry, delivered the full 656-byte
  S-response and the V-response ("dispatch armed")
* weapon log (attempt 3, live): "ioctls done s_rc=-1(22) v_rc=-1(35)
  uid=1002" and "no win this round (uid=1002)"
* /root/df5845.pwned: absent; /tmp/df5845.win: absent
* dmesg panic/Fatal count after the run: 0; guest uptime uninterrupted
* DECISIVE (fix_run.dmesg.txt): S TXDONE shows
    recv.payload=0xfffff8008f7a8000 recv.pay_len=4096
  -- the REAL fw_xfer_alloc_buf recv buffer.  On the baseline kernel the
  same ioctl shows recv.payload=S-160 recv.pay_len=1024 (the smash).
  With the fix the 44 data[] bytes land in the real send.payload buffer,
  fw_rcv_copy copies the response into the real 4096-byte recv buffer
  (in-bounds), V keeps its real act.hand, nothing escalates.
* Zero DF5845-CHAIN-WON strings in the whole fixed-run dmesg.

NOTE: fix_run.*.log.STALE-BASELINE-COPY are attempt-dir copies that the
driver failed to overwrite on the no-win run (they still contain the
baseline session win text); they are retained only to document the copy
bug, not as fixed-kernel evidence.  fix_run.dmesg.txt and
fix_run.uname.txt are the authentic fixed-run artifacts.