=== DF-1083 harness: crom_next off-by-one (CROM_MAX_DEPTH) ===
rom: 25 words, 10 nested directories
struct crom_context: sizeof=168, stack[10] would be at offset 168
after init: depth=0 (root dir crc_len=1)
walk complete: steps=10, observed max depth=9, final depth=-1
overflow_slot (== &stack[10]) AFTER walk:
  .dir   = 0x00007fffffdfd724  (sentinel was 0xDEADBEEFDEADBEEF)
  .index = 0x00000000     (sentinel was 0x12345678)

>>> BUG CONFIRMED: crom_next wrote &stack[10] OUT OF BOUNDS.
>>> The 16-byte crom_ptr past the array was overwritten:
>>>   dir set to 0x7fffffdfd724 (rom word 0x7fffffdfd850 + val offset), index set to 0.
>>> In-kernel this corrupts the kernel stack frame (return addr,
>>> saved regs) of sbp_alloc_lun/sbp_alloc_target/sbp_alloc_dev.