v0.5.9: fix OptiPlex heap crash — EBS retry must not rebuild the free list

Root cause: on real hardware SetMode can invalidate the pre-captured
ExitBootServices map key, so EBS fails and the retry refreshed the map
via capture_memory_map -> init_heap, which REBUILT the free list from
the raw map and wiped the allocation state of every pre-EBS live object
(the display shadow and the vt grids). Their spans became free while
still live, later allocations carved inside the shadow, and the display
writes clobbered them — zeroed back-pointers (family A ptr=0x404443e0
block=0x0) and gray glyph pixels (family B 0xaaaaaa00aaaaaa = 0x00AAAAAA
= PALETTE[7] fg-7 text colour, not a firmware scrub).

Fix: refresh_and_exit now re-captures the map and returns a fresh EBS
key without rebuilding the free list (refresh_map_key); the free list is
the authoritative live-allocation state. Verified in QEMU under a forced
EBS failure (SIMULATE_EBS_FAILURE test hook): verify ok, probe NOT free,
flhead outside the shadow — identical to a clean boot, and the full
shell sequence is crash-free.

Also: removed the crash-family debug markers from the screen (boot-time
heapdbg lines, vt verify marker, shadow marker) — the vt grid self-check
stays serial-only. Version 0.5.8 -> 0.5.9.

1 files changed, 32 insertions, 19 deletions

diff --git a/rsnix/src/gop.rs b/rsnix/src/gop.rs
index ecf8fa9..ccc6509 100644
--- a/rsnix/src/gop.rs
+++ b/rsnix/src/gop.rs
@@ -242,16 +242,20 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
     unsafe {
         FB = Some(fbf);
     }
+    // The RAM backbuffer is the *first* heap allocation.  It is allocated
+    // pre-ExitBootServices (before vt::init builds its grids) so it sits at
+    // the front of the free list; the heap free list already excludes the
+    // fb region (init_heap split at the fb hole) and the range-overlap
+    // check below cannot alias the display.  An ExitBootServices retry on
+    // real hardware no longer rebuilds the free list (see
+    // memory::refresh_map_key), so this pre-EBS allocation is preserved.
+    shadow_late_init();
+}
 
-    // The RAM backbuffer is the *first* heap allocation: allocated here
-    // (pre-ExitBootServices, before vt::init builds its grids) so no
-    // other heap object can collide with it — the v0.5.3 layout that
-    // provably boots on real hardware.  The heap free list excludes the
-    // fb region (init_heap splits at the fb hole) and we additionally
-    // reject any range overlapping the fb, so the shadow can never
-    // alias the display (an aliased shadow turns every scroll into a
-    // 1.8 MB MMIO→MMIO memcpy on an uncached real fb — a wedge).
-    // Allocation failure degrades to no-shadow mode, never panics.
+/// Allocate the RAM backbuffer as the FIRST heap allocation (called from
+/// `init`, pre-ExitBootServices).  Degrades to no-shadow mode (never
+/// panics) when the range would overlap the framebuffer or the alloc fails.
+pub fn shadow_late_init() {
     unsafe {
         if let Some(fbinfo) = fb().as_ref() {
             let words = (fbinfo.pitch * fbinfo.height) / 4;
@@ -293,16 +297,6 @@ pub fn init(gop: &mut GraphicsOutputProtocol) {
                         .map(|c| core::str::from_utf8(c).unwrap_or("?"))
                         .collect();
                     dump_lines(&lines);
-                    crate::gop::boot_marker_at("gop: NO-SHADOW (fallback)", bottom_row(0));
-                } else {
-                    crate::gop::boot_marker_at(
-                        &alloc::format!(
-                            "gop: shadow {:#x} {:.2} MiB",
-                            SHADOW as usize,
-                            swords as f64 * 4.0 / 1048576.0
-                        ),
-                        bottom_row(0),
-                    );
                 }
             }
         }
@@ -319,6 +313,25 @@ pub fn boot_marker(msg: &str) {
     boot_marker_at(msg, 0);
 }
 
+/// DEBUG (crash-family): read the shadow block's header words.
+/// Returns `(block_base, size, free_flag)` if a shadow is live.
+///
+/// The shadow is the first heap allocation: payload at base+32, header
+/// at base.  A live shadow shows `free == 0`; if its block ever leaked
+/// back into the free list (while `SHADOW` still points at it), later
+/// allocations carve into the zeroed span and the display writes keep
+/// zeroing them — the OptiPlex crash family signature.
+pub fn shadow_block_state() -> Option<(usize, usize, usize)> {
+    unsafe {
+        if SHADOW.is_null() {
+            return None;
+        }
+        let base = (SHADOW as usize).wrapping_sub(32);
+        let size = *(base as *const usize);
+        let free = *((base + 8) as *const usize);
+        Some((base, size, free))
+    }
+}
 /// boot_marker at an explicit text row.  The shell's first paint
 /// occupies grid rows 0 (motd) and 1 (=== banner) and the prompt sits
 /// at row 2 — markers whose *values* matter after boot (shadow state,