DF-0083 model: MAXCPU=256  sizeof(cpu_node_t)=2112 bytes
  (real build_topology_tree has NO bounds check at subr_cpu_topology.c:140-141)

N(cpu)   topology       nodes_needed   vs MAXCPU(256) OOB_writes  
6        1pkg SMT2      11             ok             0           
64       1pkg SMT2      98             ok             0           
128      1pkg SMT2      194            ok             0           
169      1pkg SMT2      255            ok             0           
170      1pkg SMT2      257            OVERFLOW       1           
192      1pkg SMT2      290            OVERFLOW       34          
256      1pkg SMT2      386            OVERFLOW       130         
384      1pkg SMT2      578            OVERFLOW       322         
512      1pkg SMT2      770            OVERFLOW       514         

[*] Threshold: nodes_needed > 256 first at N=170 (2 + 3*85 = 257). For N=256 (128c/256t): 386 nodes -> 130 OOB writes past cpu_topology_nodes[256], i.e. ~268 KB of BSS corruption at boot.
[*] This guest: hw.ncpu=6 -> tree needs 14 nodes (no OOB); the bug is dormant here but real on >=170-CPU systems.

RESULT: OOB_CONFIRMED — build_topology_tree cursor exceeds cpu_topology_nodes[MAXCPU] for >=170 logical CPUs (no bounds check in source).