v0.5.9: fix OptiPlex heap crash — EBS retry must not rebuild the free list

Root cause: on real hardware SetMode can invalidate the pre-captured
ExitBootServices map key, so EBS fails and the retry refreshed the map
via capture_memory_map -> init_heap, which REBUILT the free list from
the raw map and wiped the allocation state of every pre-EBS live object
(the display shadow and the vt grids). Their spans became free while
still live, later allocations carved inside the shadow, and the display
writes clobbered them — zeroed back-pointers (family A ptr=0x404443e0
block=0x0) and gray glyph pixels (family B 0xaaaaaa00aaaaaa = 0x00AAAAAA
= PALETTE[7] fg-7 text colour, not a firmware scrub).

Fix: refresh_and_exit now re-captures the map and returns a fresh EBS
key without rebuilding the free list (refresh_map_key); the free list is
the authoritative live-allocation state. Verified in QEMU under a forced
EBS failure (SIMULATE_EBS_FAILURE test hook): verify ok, probe NOT free,
flhead outside the shadow — identical to a clean boot, and the full
shell sequence is crash-free.

Also: removed the crash-family debug markers from the screen (boot-time
heapdbg lines, vt verify marker, shadow marker) — the vt grid self-check
stays serial-only. Version 0.5.8 -> 0.5.9.

1 files changed, 105 insertions, 2 deletions

diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index 3ba53fc..099f607 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -624,6 +624,20 @@ fn heap_guard_report(ptr: usize, rsp: usize, size: usize, align: usize) -> ! {
 /// .bss working buffer so no pool allocation (and thus no memory-map change)
 /// occurs between GetMemoryMap and ExitBootServices.
 pub fn capture_memory_map(bs: &BootServices) -> Result<usize, Status> {
+    capture_memory_map_impl(bs, true)
+}
+
+/// Re-capture the memory map and return a FRESH ExitBootServices key
+/// WITHOUT rebuilding the heap free list.  Used by the EBS retry path:
+/// a rebuild from the raw map wipes the allocation state of every
+/// pre-EBS live allocation (the display shadow, the vt grids) — their
+/// spans then become free while still in use, and later allocations
+/// land inside the live shadow (the OptiPlex crash family).
+pub fn refresh_map_key(bs: &BootServices) -> Result<usize, Status> {
+    capture_memory_map_impl(bs, false)
+}
+
+fn capture_memory_map_impl(bs: &BootServices, rebuild: bool) -> Result<usize, Status> {
     let mut map_key: usize = 0;
     let mut desc_size: usize = 0;
     let mut desc_ver: u32 = 0;
@@ -694,7 +708,9 @@ pub fn capture_memory_map(bs: &BootServices) -> Result<usize, Status> {
     // Do NOT free anything — the static buffer stays.  Map key is still
     // valid because no pool allocation/free happened after GetMemoryMap.
 
-    init_heap();
+    if rebuild {
+        init_heap();
+    }
     Ok(map_key)
 }
 
@@ -705,7 +721,13 @@ pub fn capture_memory_map(bs: &BootServices) -> Result<usize, Status> {
 /// `image_handle` must be the valid EFI image handle this kernel was
 /// started with (opaque firmware pointer; never dereferenced here).
 pub unsafe fn refresh_and_exit(bs: &BootServices, image_handle: Handle) -> Result<usize, Status> {
-    let key = capture_memory_map(bs)?;
+    // Fresh key WITHOUT rebuilding the heap free list: a rebuild from the
+    // raw map wipes the allocation state of every pre-EBS live allocation
+    // (the display shadow, the vt grids) — their spans then become free
+    // while still in use, and later allocations land inside the live
+    // shadow (the OptiPlex crash family: display writes clobber heap
+    // objects, zeroed back-pointers, gray-text pixels).
+    let key = refresh_map_key(bs)?;
     let status = unsafe { (bs.exit_boot_services)(image_handle, key) };
     if status == EFI_SUCCESS {
         Ok(key)
@@ -833,6 +855,87 @@ pub fn heap_stats() -> HeapStats {
     }
 }
 
+/// DEBUG (crash-family): which free block contains `addr`, if any.
+/// Returns `(block_base, block_size, offset_within_block)`.
+///
+/// The OptiPlex heap-corruption dumps land at deterministic offsets
+/// inside the shadow's would-be span; this tells us whether the shadow
+/// block (or any block spanning that offset) has leaked back into the
+/// free list at shell entry or later.
+pub fn freelist_contains(addr: usize) -> Option<(usize, usize, usize)> {
+    unsafe {
+        let mut cur = FREE_LIST;
+        while !cur.is_null() {
+            let base = cur as usize;
+            let size = (*cur).size;
+            if addr >= base && addr < base.saturating_add(size) {
+                return Some((base, size, addr - base));
+            }
+            cur = (*(*cur).links()).next;
+        }
+        None
+    }
+}
+
+/// DEBUG (crash-family): the free list head block (base, size).
+pub fn freelist_head() -> Option<(usize, usize)> {
+    unsafe {
+        if FREE_LIST.is_null() {
+            None
+        } else {
+            Some((FREE_LIST as usize, (*FREE_LIST).size))
+        }
+    }
+}
+
+/// DEBUG (OptiPlex sim): force the first ExitBootServices call to fail,
+/// exercising the capture_memory_map -> init_heap free-list rebuild that
+/// wiped the pre-EBS shadow on real hardware.  Returns true when the
+/// simulation is armed (one shot).
+pub static mut SIMULATE_EBS_FAILURE: bool = false;
+pub fn simulate_ebs_failure() -> bool {
+    unsafe {
+        let r = SIMULATE_EBS_FAILURE;
+        SIMULATE_EBS_FAILURE = false;
+        r
+    }
+}
+
+/// DEBUG (crash-family): walk the free list, formatting at most `max`
+/// blocks as text lines for the screen/serial.
+///
+/// Snapshot the walk into a fixed stack array first: printing the lines
+/// itself allocates, and an interleaved alloc/free would shift the list
+/// under the walk (the shell's tty path allocates per line).
+pub fn freelist_lines(max: usize) -> alloc::vec::Vec<alloc::string::String> {
+    let mut out = alloc::vec::Vec::new();
+    unsafe {
+        let mut cur = FREE_LIST;
+        let cap = max.min(24);
+        let mut snap: [(usize, usize); 24] = [(0, 0); 24];
+        let mut seen = 0usize;
+        while !cur.is_null() && seen < cap {
+            snap[seen] = (cur as usize, (*cur).size);
+            seen += 1;
+            cur = (*(*cur).links()).next;
+        }
+        if seen == 0 {
+            out.push("fl[] EMPTY".into());
+        } else {
+            for (base, size) in snap[..seen].iter() {
+                out.push(alloc::format!(
+                    "fl[{}] {:#x} size={:#x} end={:#x}",
+                    out.len(),
+                    base,
+                    size,
+                    base.wrapping_add(*size)
+                ));
+            }
+        }
+    }
+    out
+}
+
 /// Allocator smoke test — exercises alloc/free/coalesce without touching
 /// the heap itself (fixed-size stack arrays only).  Returns true on success.
 pub fn self_test() -> bool {