v0.5.7: drop test-poison hooks; vt heap-struct verify at shell entry

The OptiPlex's first banner write #GPs when the vt cells VecData holds
firmware 0xAA fill instead of a real buffer pointer.  The poison/fill
test hooks (stack + free-heap + free-page 0x00AAAAAA) were removed from
the release image — they changed boot behavior and may walk a corrupt
free list over live blocks.  Added vt::debug_verify() (cells/rendered
ptr/cap/len + in-heap check) at shell entry: the next real-hardware
boot shows whether the corruption is present at shell entry or lands
during the banner write.

2 files changed, 49 insertions, 33 deletions

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index 52b37ec..42f95e5 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -344,22 +344,13 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     } else {
         rsnix::serial_println!("cursor: no mouse — overlay disabled");
     }
-    // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in
-    // QEMU.  The real hardware's stack carries 0xAA fill left by
-    // firmware; any shell value that is dropped without being written
-    // then frees garbage and trips the dealloc guard.  Filling the
-    // shell's future stack region with 0xAA here makes the same bug
-    // visible on QEMU (serial + gdb available) instead of only on the
-    // OptiPlex.
-    stack_fill_aa();
-    // Poison the free heap AND the free pages with the OptiPlex's
-    // 0x00AAAAAA scrub pattern — the firmware's leftover fills both the
-    // heap (freed pool) and the pages the allocators hand out (heap
-    // growth, task stacks).  Together with the stack fill this makes
-    // any uninitialized read reproduce the real machine's crashes in
-    // QEMU (garbage sizes → alloc panics, garbage ptrs → dealloc guard).
-    rsnix::memory::poison_free_blocks_aa();
-    rsnix::memory::poison_free_pages_aa();
+    // Shell-entry self-check: verify the vt grid structs are sane right
+    // before the shell's first print.  The OptiPlex crashes in the first
+    // banner write when the cells VecData (or the shadow) holds the
+    // firmware's 0xAA fill instead of real values — this line shows
+    // whether the corruption is already present at shell entry or lands
+    // later, and prints the exact field values when it is.
+    rsnix::vt::debug_verify();
     shell::run();
 }
 
@@ -368,23 +359,6 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
 /// headroom.  128 KiB covers the whole shell frame chain on QEMU and
 /// the OptiPlex.  Best-effort: the region is below rsp inside the boot
 /// stack mapping; the call into `shell::run` overwrites the top word.
-fn stack_fill_aa() {
-    let rsp: usize;
-    unsafe {
-        core::arch::asm!("mov {}, rsp", out(reg) rsp);
-    }
-    let top = rsp - 0x100;
-    let bottom = rsp - 0x21100;
-    unsafe {
-        let mut p = bottom;
-        while p < top {
-            core::ptr::write_volatile(p as *mut u64, 0x00AAAAAA00AAAAAA);
-            p += 8;
-        }
-    }
-    rsnix::serial_println!("stack: 0x00AAAAAA-fill 0x{:x}..0x{:x}", bottom, top);
-}
-
 // ---------------------------------------------------------------------------
 // Print a memory summary from the stashed memory map
 // ---------------------------------------------------------------------------
diff --git a/rsnix/src/vt.rs b/rsnix/src/vt.rs
index 4578f6c..6343b78 100644
--- a/rsnix/src/vt.rs
+++ b/rsnix/src/vt.rs
@@ -138,6 +138,48 @@ pub fn size() -> (usize, usize) {
     unsafe { (ROWS, COLS) }
 }
 
+/// Shell-entry self-check: dump the vt grid's heap structs so a real-
+/// hardware boot shows whether the cells VecData / data arrays are sane
+/// at shell entry (the OptiPlex's first banner write #GPs when the
+/// cells buffer holds firmware 0xAA fill instead of real pointers).
+pub fn debug_verify() {
+    unsafe {
+        let total = ROWS * COLS;
+        let msg = |m: &str| {
+            crate::serial_println!("vt: {}", m);
+        };
+        if CELLS.is_null() || RENDERED.is_null() {
+            msg("verify: cells/renderd NULL — vt::init did not run");
+            return;
+        }
+        let c = &*(CELLS as *const Vec<Cell>);
+        let r = &*(RENDERED as *const Vec<Cell>);
+        msg(&alloc::format!(
+            "verify: cells ptr={:#x} cap={:#x} len={:#x} rendered ptr={:#x} cap={:#x} len={:#x} want={:#x}",
+            c.as_ptr() as usize,
+            c.capacity(),
+            c.len(),
+            r.as_ptr() as usize,
+            r.capacity(),
+            r.len(),
+            total
+        ));
+        // The cells array must cover rows*cols and be inside the heap.
+        let heap_ok = crate::memory::heap_range()
+            .map(|(hs, he)| {
+                let p = c.as_ptr() as usize;
+                let bytes = c.capacity().saturating_mul(core::mem::size_of::<Cell>());
+                p >= hs && p + bytes <= he
+            })
+            .unwrap_or(false);
+        if c.len() != total || r.len() != total || !heap_ok {
+            msg("verify: FAILED — cells/rendered not sane at shell entry");
+        } else {
+            msg("verify: ok");
+        }
+    }
+}
+
 pub fn set_cursor_visible(v: bool) {
     sync_scroll();
     unsafe {