=== UNFIXED harness logic (proves the bug exists in original code) ===
=== DF-1083 harness: crom_next off-by-one (CROM_MAX_DEPTH) ===
rom: 25 words, 10 nested directories
struct crom_context: sizeof=168, stack[10] would be at offset 168
after init: depth=0 (root dir crc_len=1)
walk complete: steps=10, observed max depth=9, final depth=-1
overflow_slot (== &stack[10]) AFTER walk:
  .dir   = 0x00007fffffdfd814  (sentinel was 0xDEADBEEFDEADBEEF)
  .index = 0x00000000     (sentinel was 0x12345678)

>>> BUG CONFIRMED: crom_next wrote &stack[10] OUT OF BOUNDS.
>>> The 16-byte crom_ptr past the array was overwritten:
>>>   dir set to 0x7fffffdfd814 (rom word 0x7fffffdfd940 + val offset), index set to 0.
>>> In-kernel this corrupts the kernel stack frame (return addr,
>>> saved regs) of sbp_alloc_lun/sbp_alloc_target/sbp_alloc_dev.
exit=1

=== FIXED harness logic (proves the one-line fix closes it) ===
=== DF-1083 harness: crom_next off-by-one (CROM_MAX_DEPTH) ===
rom: 25 words, 10 nested directories
struct crom_context: sizeof=168, stack[10] would be at offset 168
after init: depth=0 (root dir crc_len=1)
crom_next: too deep
walk complete: steps=10, observed max depth=9, final depth=-1
overflow_slot (== &stack[10]) AFTER walk:
  .dir   = 0xdeadbeefdeadbeef  (sentinel was 0xDEADBEEFDEADBEEF)
  .index = 0x12345678     (sentinel was 0x12345678)

>>> canary intact: no OOB write (guard fired correctly).
exit=0