sema: rescue by exact release group at any offset, with validated pin alignment

Kernel: the slot-aligned failing entries carry pushes whose release group
is not at the page's fixed +0x10 offset, so the shape matcher found
nothing. Scan every 4-byte offset for the exact group (hdr 0x20038090,
hi==1, lo&0xfff==slot, follower LAUNCH_DMA sem-release; payload may lag
the tracked expectation) with the header compared first. Each match
yields two candidate pin bases - the group's page and the page implied by
treating the group as the end of this entry's push - and each candidate
is validated by pinning and reading the entry VA back before it is
accepted. Live: 13 rescues pinned the MEMOPS slots; the 12700-byte push
then decoded to 29 op-runs with a real release, and memset=338 fills
(page-table clears) executed ~13 s before the client's rc=999.

0 files changed, 0 insertions, 0 deletions