DF-1161 PoC verification — source-level trace of mpt_fc_els_reply_handler
unbounded els_cmd_ptrs[] index bug.

The mpt(4) driver is compiled into the X86_64_GENERIC kernel
(`sys/config/X86_64_GENERIC:93`) but no LSI-Logic MPT-Fusion FC HBA is present
in the QEMU guest, so `mpt->is_fc` is never set and the ELS reply handler is
never dispatched. Verification is by source-level trace + build-validation of
the fix.

## Bug location
- `sys/dev/disk/mpt/mpt_cam.c:2951` — `ioindex = le32toh(rp->TransactionContext);`
- `sys/dev/disk/mpt/mpt_cam.c:2952` — `req = mpt->els_cmd_ptrs[ioindex];` (no bounds)
- `els_cmd_ptrs` allocated at `mpt_cam.c:4208` (64 ptrs = MPT_MAX_ELS)
- Symmetric guard that exists for the SRVC_RSP path: `mpt_cam.c:2886-2892`

## Mechanism
IOC DMA-supplied U32 `TransactionContext` is used directly as an array index
into the 64-entry `els_cmd_ptrs[]` with no bounds check. A malicious or buggy
IOC reply with MsgLength > 5 and `TransactionContext >= 64` reads an
attacker-influenced kernel pointer past the array and then dereferences it as a
live `request_t *` (TAILQ_REMOVE, bitfield writes, memcpy through req_vbuf).

## Reproduce
1. Apply `fix.diff` to /usr/src.
2. `cd /usr/src/sys/dev/disk/mpt && make KMOD=mpt`  →  mpt.ko builds clean.
3. Runtime test requires LSI-Logic MPT-Fusion FC HBA (not present on this guest).

See `VERDICT.md` for the full analysis.