v0.5.7: guard report 4-words-per-line — 16 stack words survive band hand-copy

The OptiPlex repro copies are truncated at the ~110-char band width, so
the old single-line 'stk:' (12 words, >200 chars) lost the return chain
after a few words.  Split mem/stk dumps into 4-words-per-line blocks:
mem+mem2 (8 words around the corruption) and stk..stk4 (16 words) —
the drop caller chain now survives hand transcription.

1 files changed, 29 insertions, 0 deletions

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index cbbf2ba..806f150 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -344,9 +344,38 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     } else {
         rsnix::serial_println!("cursor: no mouse — overlay disabled");
     }
+    // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in
+    // QEMU.  The real hardware's stack carries 0xAA fill left by
+    // firmware; any shell value that is dropped without being written
+    // then frees garbage and trips the dealloc guard.  Filling the
+    // shell's future stack region with 0xAA here makes the same bug
+    // visible on QEMU (serial + gdb available) instead of only on the
+    // OptiPlex.
+    stack_fill_aa();
     shell::run();
 }
 
+/// Write 0xAA over the stack region the shell's frames will reuse,
+/// leaving the current frames (top 4 KiB) intact.  128 KiB covers the
+/// whole shell frame chain on QEMU and the OptiPlex.  Best-effort: the
+/// region is below rsp inside the boot stack mapping.
+fn stack_fill_aa() {
+    let rsp: usize;
+    unsafe {
+        core::arch::asm!("mov {}, rsp", out(reg) rsp);
+    }
+    let top = rsp - 0x1000;
+    let bottom = rsp - 0x21000;
+    unsafe {
+        let mut p = bottom;
+        while p < top {
+            core::ptr::write_volatile(p as *mut u64, 0xAAAAAAAAAAAAAAAA);
+            p += 8;
+        }
+    }
+    rsnix::serial_println!("stack: 0xAA-fill 0x{:x}..0x{:x}", bottom, top);
+}
+
 // ---------------------------------------------------------------------------
 // Print a memory summary from the stashed memory map
 // ---------------------------------------------------------------------------