### DF-0987 VULNERABLE build+run
starting_track=0 ending_track=255 -> num_entries=257 (cap=100)
toclen=2056  DMA length into &softc->toc = 2060  (buffer = 804)
(DMA length exceeds harness region; clamped for demo)
subsequent entries[256] write (cap=100) -> OOB by 157 entries
overflow past softc->toc: 1256 bytes (clobbered 1024 tail bytes)
RESULT: OVERFLOW CONFIRMED — 1256-byte heap overflow into softc / M_DEVBUF
rc=1