=== DF-1035 trigger documentation ===

Vulnerable path (bus_dmamap_load_uio, multi-iovec uio):
  caller (mpr.c/mps.c/isp_pci.c) builds a uio with N>=2 iovecs
  where the first iov maps to more than dmat->nsegments/2 DMA
  segments, then invokes bus_dmamap_load_uio()
    -> loop over uio->uio_iov
       -> _bus_dmamap_load_buffer(segs=segments+M, nsegments=N-M,
                                 segp=&nsegs)
          *segp is the absolute index M from the prior iov
          KKASSERT(M <= N-M)  -- fires on GENERIC (INVARIANTS on)
          without INVARIANTS: sg = &local_segments[M-1]
                              = &original_segments[M+M-1]
                              -- OOB write into the segments array

Status on this audit guest: not live-reachable — none of the
three HBA callers (mpr/mps/isp) attach. The broken function IS
in /boot/kernel/kernel (verified via nm). Fix validated by
nativekernel rebuild — see VERDICT.md.
RUN_EXIT=0