Off-by-two OOB write when full input line terminated with Enter

Summary

Printable-character insert guard is if(db_le==db_lbuf_end) with db_lbuf_end=lstart+lsize so it permits exactly lsize chars to fill whole buffer leaving no room for trailing newline or NUL. Pressing Enter writes \n one byte past end and subsequent NUL-termination writes second byte past end deterministic 2-byte OOB write on caller buffer. db_readline sets db_lbuf_end=lstart+lsize (db_input.c:309). Insert bound check at :267 if(db_le==db_lbuf_end) only fires AFTER lsize chars occupy indices [0..lsize-1] and db_le reached db_lbuf_end. Enter handler at :264 executes *db_le++=c writing \n at index lsize (1 byte past end). Returns loop exits :317 *db_le=0 writes \0 at index lsize+1 (2 bytes past end). Also full line stored into history without NUL terminator so CTRL(p) recall makes index() over-read past buffer and redraw prints kernel bytes to DDB console. DDB-only privileged context no privilege boundary crossed defense-in-depth. [VERIFIED pass2: canary-proven 2-byte OOB 0x0d at buf 128 and NUL at buf 129 with 128 chars plus Enter, real victim db_line 120 in bss; lbuf_end minus 2 guard fix-validated 0 corrupted bytes]