1 files changed, 17 insertions, 8 deletions

diff --git a/rsdos/src/main.rs b/rsdos/src/main.rs
index 806f150..52b37ec 100644
--- a/rsdos/src/main.rs
+++ b/rsdos/src/main.rs
@@ -352,28 +352,37 @@ pub unsafe extern "efiapi" fn efi_main(image_handle: Handle, system_table: *mut
     // visible on QEMU (serial + gdb available) instead of only on the
     // OptiPlex.
     stack_fill_aa();
+    // Poison the free heap AND the free pages with the OptiPlex's
+    // 0x00AAAAAA scrub pattern — the firmware's leftover fills both the
+    // heap (freed pool) and the pages the allocators hand out (heap
+    // growth, task stacks).  Together with the stack fill this makes
+    // any uninitialized read reproduce the real machine's crashes in
+    // QEMU (garbage sizes → alloc panics, garbage ptrs → dealloc guard).
+    rsnix::memory::poison_free_blocks_aa();
+    rsnix::memory::poison_free_pages_aa();
     shell::run();
 }
 
-/// Write 0xAA over the stack region the shell's frames will reuse,
-/// leaving the current frames (top 4 KiB) intact.  128 KiB covers the
-/// whole shell frame chain on QEMU and the OptiPlex.  Best-effort: the
-/// region is below rsp inside the boot stack mapping.
+/// Write the OptiPlex's 0x00AAAAAA scrub pattern over the stack region
+/// the shell's frames will reuse, leaving only 256 B of live frame
+/// headroom.  128 KiB covers the whole shell frame chain on QEMU and
+/// the OptiPlex.  Best-effort: the region is below rsp inside the boot
+/// stack mapping; the call into `shell::run` overwrites the top word.
 fn stack_fill_aa() {
     let rsp: usize;
     unsafe {
         core::arch::asm!("mov {}, rsp", out(reg) rsp);
     }
-    let top = rsp - 0x1000;
-    let bottom = rsp - 0x21000;
+    let top = rsp - 0x100;
+    let bottom = rsp - 0x21100;
     unsafe {
         let mut p = bottom;
         while p < top {
-            core::ptr::write_volatile(p as *mut u64, 0xAAAAAAAAAAAAAAAA);
+            core::ptr::write_volatile(p as *mut u64, 0x00AAAAAA00AAAAAA);
             p += 8;
         }
     }
-    rsnix::serial_println!("stack: 0xAA-fill 0x{:x}..0x{:x}", bottom, top);
+    rsnix::serial_println!("stack: 0x00AAAAAA-fill 0x{:x}..0x{:x}", bottom, top);
 }
 
 // ---------------------------------------------------------------------------