v0.5.7: guard report 4-words-per-line — 16 stack words survive band hand-copy

The OptiPlex repro copies are truncated at the ~110-char band width, so
the old single-line 'stk:' (12 words, >200 chars) lost the return chain
after a few words.  Split mem/stk dumps into 4-words-per-line blocks:
mem+mem2 (8 words around the corruption) and stk..stk4 (16 words) —
the drop caller chain now survives hand transcription.

2 files changed, 89 insertions, 24 deletions

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index cbbf2ba..806f150 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -344,9 +344,38 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     } else {
         rsnix::serial_println!("cursor: no mouse — overlay disabled");
     }
+    // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in
+    // QEMU.  The real hardware's stack carries 0xAA fill left by
+    // firmware; any shell value that is dropped without being written
+    // then frees garbage and trips the dealloc guard.  Filling the
+    // shell's future stack region with 0xAA here makes the same bug
+    // visible on QEMU (serial + gdb available) instead of only on the
+    // OptiPlex.
+    stack_fill_aa();
     shell::run();
 }
 
+/// Write 0xAA over the stack region the shell's frames will reuse,
+/// leaving the current frames (top 4 KiB) intact.  128 KiB covers the
+/// whole shell frame chain on QEMU and the OptiPlex.  Best-effort: the
+/// region is below rsp inside the boot stack mapping.
+fn stack_fill_aa() {
+    let rsp: usize;
+    unsafe {
+        core::arch::asm!("mov {}, rsp", out(reg) rsp);
+    }
+    let top = rsp - 0x1000;
+    let bottom = rsp - 0x21000;
+    unsafe {
+        let mut p = bottom;
+        while p < top {
+            core::ptr::write_volatile(p as *mut u64, 0xAAAAAAAAAAAAAAAA);
+            p += 8;
+        }
+    }
+    rsnix::serial_println!("stack: 0xAA-fill 0x{:x}..0x{:x}", bottom, top);
+}
+
 // ---------------------------------------------------------------------------
 // Print a memory summary from the stashed memory map
 // ---------------------------------------------------------------------------
diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index 3362d94..ecaf806 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -405,58 +405,94 @@ fn heap_guard_report(ptr: usize, rsp: usize) -> ! {
     // Words around the block header — the corruption lives in the
     // header's size/free slots or the payload.  Only when the addresses
     // are inside the mapped heap (reading a garbage pointer would fault
-    // mid-report).
-    let mut b4 = [0u8; 216];
-    let n4 = {
-        let mut w = crate::strbuf::FmtBuf::new(&mut b4);
+    // mid-report).  Four words per line: the fault band is ~110 chars
+    // wide, so one long line would truncate under hand-copy.
+    let mut b4 = [0u8; 96];
+    let mut b4b = [0u8; 96];
+    let (n4, n4b) = {
         let focus = if block >= hs && block < he { block } else { ptr };
         if focus >= hs + 8 && focus < he {
             let lo = (focus - 16).max(hs);
             let hi = (focus + 40).min(he - 8);
+            let mut w = crate::strbuf::FmtBuf::new(&mut b4);
             let _ = fmt::write(&mut w, core::format_args!("mem:"));
             let mut a = lo & !7;
-            while a <= hi {
+            let mut n = 0;
+            while a <= hi && n < 4 {
                 let _ = fmt::write(
                     &mut w,
                     core::format_args!(" {:x}={:#x}", a, unsafe { *(a as *const usize) }),
                 );
                 a += 8;
+                n += 1;
             }
+            let mut w2 = crate::strbuf::FmtBuf::new(&mut b4b);
+            let _ = fmt::write(&mut w2, core::format_args!("mem2:"));
+            let mut n = 0;
+            while a <= hi && n < 4 {
+                let _ = fmt::write(
+                    &mut w2,
+                    core::format_args!(" {:x}={:#x}", a, unsafe { *(a as *const usize) }),
+                );
+                a += 8;
+                n += 1;
+            }
+            (w.len(), w2.len())
         } else {
+            let mut w = crate::strbuf::FmtBuf::new(&mut b4);
             let _ = fmt::write(&mut w, core::format_args!("mem: out of heap — no dump"));
+            (w.len(), 0)
         }
-        w.len()
     };
 
     // Live return-address chain on the stack above our rsp (dealloc ←
     // drop glue ← shell::run); raw stack words, resolves against the PDB.
-    let mut b5 = [0u8; 216];
-    let n5 = {
-        let mut w = crate::strbuf::FmtBuf::new(&mut b5);
-        let _ = fmt::write(&mut w, core::format_args!("stk:"));
+    // 16 words in 4 lines of 4 — enough to capture the drop caller
+    // chain on the band even when the copy truncates a line.
+    let mut b5 = [0u8; 96];
+    let mut b6 = [0u8; 96];
+    let mut b7 = [0u8; 96];
+    let mut b8 = [0u8; 96];
+    let (n5, n6, n7, n8) = {
         let mut a = rsp.wrapping_add(8);
-        for _ in 0..12 {
-            let v = unsafe { *(a as *const usize) };
-            let _ = fmt::write(&mut w, core::format_args!(" {:x}={:#x}", a, v));
-            a += 8;
+        let bufs: [&mut [u8]; 4] = [&mut b5, &mut b6, &mut b7, &mut b8];
+        let mut lens = [0usize; 4];
+        for li in 0..4 {
+            let mut w = crate::strbuf::FmtBuf::new(bufs[li]);
+            let lbl = match li {
+                0 => "",
+                1 => "2",
+                2 => "3",
+                _ => "4",
+            };
+            let _ = fmt::write(
+                &mut w,
+                core::format_args!("stk{}:", lbl),
+            );
+            for _ in 0..4 {
+                let v = unsafe { *(a as *const usize) };
+                let _ = fmt::write(&mut w, core::format_args!(" {:x}={:#x}", a, v));
+                a += 8;
+            }
+            lens[li] = w.len();
         }
-        w.len()
+        (lens[0], lens[1], lens[2], lens[3])
     };
 
     let l1 = core::str::from_utf8(&b1[..n1]).unwrap_or("!!!");
     let l2 = core::str::from_utf8(&b2[..n2]).unwrap_or("");
     let l3 = core::str::from_utf8(&b3[..n3]).unwrap_or("");
     let l4 = core::str::from_utf8(&b4[..n4]).unwrap_or("");
+    let l4b = if n4b > 0 { core::str::from_utf8(&b4b[..n4b]).unwrap_or("") } else { "" };
     let l5 = core::str::from_utf8(&b5[..n5]).unwrap_or("");
-    crate::serial::write_raw(l2);
-    crate::serial::write_raw("\r\n");
-    crate::serial::write_raw(l3);
-    crate::serial::write_raw("\r\n");
-    crate::serial::write_raw(l4);
-    crate::serial::write_raw("\r\n");
-    crate::serial::write_raw(l5);
-    crate::serial::write_raw("\r\n");
-    let lines = [l1, l2, l3, l4, l5];
+    let l6 = core::str::from_utf8(&b6[..n6]).unwrap_or("");
+    let l7 = core::str::from_utf8(&b7[..n7]).unwrap_or("");
+    let l8 = core::str::from_utf8(&b8[..n8]).unwrap_or("");
+    for l in [l2, l3, l4, l4b, l5, l6, l7, l8] {
+        crate::serial::write_raw(l);
+        crate::serial::write_raw("\r\n");
+    }
+    let lines = [l1, l2, l3, l4, l4b, l5, l6, l7, l8];
     crate::gop::dump_lines(&lines);
     crate::fs::write_crash_log(&lines);
     crate::interrupts::halt()