=== DF-0546: netmap_mem_ofstophys lut[] OOB read ===

NOTE: netmap is NOT compiled on DragonFlyBSD master.
      Bug confirmed by source trace; harness demonstrates the logic.

Pool parameters (objsize=1500):
  _objsize     = 1500
  _clustsize   = 4096 (rounded up from 3000)
  clustentries = 2
  numclusters  = 16
  objtotal     = 32 (lut has this many entries)
  memtotal     = 65536 (offset validated against this)
  objtotal*objsize = 48000
  OOB window   = [48000, 65536) = 17536 bytes

[1] Valid offset 46500:
  -> pa = 0x1000b5a4 (valid)

[2] OOB offset 48100 (in padding window):
  offset < memtotal (48100 < 65536)? YES — passes check
  -> lut index 32 >= objtotal 32 -> OOB READ!
  -> reads 0 bytes past lut array end
  -> pa = 0xdeadbeef (GARBAGE from adjacent slab heap)

=== BUG CONFIRMED ===
Offset in [objtotal*_objsize, memtotal) passes validation
but produces lut index >= objtotal -> OOB read of adjacent heap.
Garbage paddr mapped into userspace -> info leak / arbitrary phys R/W.
RUN_EXIT=0