sleepq_chains[] has 1024 entries (indices 0..1023 allowed)
wchan                  SLEEPQ_HASH          IN-BOUNDS?     fixed
0xffff800000000000       0x003fffe000000000     *** OOB ***    0x0
0xffffffff80b34000       0x003fffffffe02cd0     *** OOB ***    0xd0
0xfffffe0012345678       0x003fffff80048f6d     *** OOB ***    0x36d
0xffff800123456000       0x003fffe00048d158     *** OOB ***    0x158
0xffff8000deadbeef       0x003fffe00037a980     *** OOB ***    0x180
0x0000000000401fc0       0x00000000000013c7     *** OOB ***    0x3c7

6/6 realistic kernel wchan pointers produce an OUT-OF-BOUNDS index into sleepq_chains[1024].

Emulating SLEEPQ_LOOKUP(0xffff8000deadbeef) on array @ 0x401fc0:
  index = 0x3fffe00037a980  (array has 1024 slots)
  &sleepq_chains[index] = 0x7fffc0007354fc0  -> 576456354373644288 BYTES past array start
  spin_lock()/TAILQ on this address corrupts unrelated kernel memory.

RESULT: BUG CONFIRMED -- SLEEPQ_HASH returns out-of-range indices for normal kernel pointers.
RUN_EXIT=0