1 files changed, 16 insertions, 0 deletions

diff --git a/shell/src/lib.rs b/shell/src/lib.rs
index a32d259..175a2c7 100644
--- a/shell/src/lib.rs
+++ b/shell/src/lib.rs
@@ -740,6 +740,7 @@ write `{} <path> TIL <marker>`",
         "kill" => cmd_kill(&parsed),
         "demo" => cmd_demo(&parsed),
         "fault" => cmd_fault(),
+        "corrupt" => cmd_corrupt(),
         "crashlog" => cmd_crashlog(),
         "stall" => cmd_stall(&parsed),
         _ => term_err(&alloc::format!("unknown command: {}", cmd)),
@@ -839,6 +840,21 @@ fn cmd_fault() {
     }
 }
 
+/// Deliberately clobber a live heap block's back-pointer, then free it —
+/// test hook that proves the allocator's corruption guard fires with a
+/// readable report (instead of a #GP inside `__rust_dealloc`).  The
+/// system stops; the log must show `!!! heap corruption in dealloc`.
+fn cmd_corrupt() {
+    term_println("corrupt: clobbering a live block's back-pointer...");
+    let s = String::from("hello heap guard");
+    let ptr = s.as_ptr() as usize;
+    unsafe {
+        *((ptr - 8) as *mut usize) = 0xdeed_beef_deed_beefusize;
+    }
+    drop(s);
+    term_println("corrupt: guard did NOT fire (unexpected)");
+}
+
 /// Debug hook: run the crash-log FAT write from the *shell* context (not
 /// the fault ISR) to compare behaviour.
 fn cmd_crashlog() {