1 files changed, 29 insertions, 0 deletions

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index cbbf2ba..806f150 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -344,9 +344,38 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     } else {
         rsnix::serial_println!("cursor: no mouse — overlay disabled");
     }
+    // TEST HOOK: reproduce the OptiPlex '0xaaaaaa' uninit-drop crash in
+    // QEMU.  The real hardware's stack carries 0xAA fill left by
+    // firmware; any shell value that is dropped without being written
+    // then frees garbage and trips the dealloc guard.  Filling the
+    // shell's future stack region with 0xAA here makes the same bug
+    // visible on QEMU (serial + gdb available) instead of only on the
+    // OptiPlex.
+    stack_fill_aa();
     shell::run();
 }
 
+/// Write 0xAA over the stack region the shell's frames will reuse,
+/// leaving the current frames (top 4 KiB) intact.  128 KiB covers the
+/// whole shell frame chain on QEMU and the OptiPlex.  Best-effort: the
+/// region is below rsp inside the boot stack mapping.
+fn stack_fill_aa() {
+    let rsp: usize;
+    unsafe {
+        core::arch::asm!("mov {}, rsp", out(reg) rsp);
+    }
+    let top = rsp - 0x1000;
+    let bottom = rsp - 0x21000;
+    unsafe {
+        let mut p = bottom;
+        while p < top {
+            core::ptr::write_volatile(p as *mut u64, 0xAAAAAAAAAAAAAAAA);
+            p += 8;
+        }
+    }
+    rsnix::serial_println!("stack: 0xAA-fill 0x{:x}..0x{:x}", bottom, top);
+}
+
 // ---------------------------------------------------------------------------
 // Print a memory summary from the stashed memory map
 // ---------------------------------------------------------------------------