DF-1162 PoC verification — source-level trace of mpt_fc_els_reply_handler
tgt_cmd_ptrs[rx_id] bound mismatch.

The mpt(4) driver is compiled into the X86_64_GENERIC kernel
(`sys/config/X86_64_GENERIC:93`) but no LSI-Logic MPT-Fusion FC HBA is present
in the QEMU guest, so `mpt->is_fc` is never set and the ABTS path of the ELS
reply handler is never entered. Verification is by source-level trace +
build-validation of the fix.

## Bug location
- `sys/dev/disk/mpt/mpt_cam.c:3004` — `if (rx_id >= mpt->mpt_max_tgtcmds)` (wrong bound)
- `sys/dev/disk/mpt/mpt_cam.c:3009` — `tgt_req = mpt->tgt_cmd_ptrs[rx_id];` (OOB)
- `tgt_cmd_ptrs` allocated at `mpt_cam.c:4251-4256` (capped at MPT_MAX_REQUESTS/2)
- Correct bound already used at `mpt.c:765` (`tgt_cmds_allocated`)

## Mechanism
`tgt_cmd_ptrs` is allocated as `min(MPT_MAX_REQUESTS/2, mpt_max_tgtcmds)`
entries, but the ABTS RX_ID check uses `mpt_max_tgtcmds`. When
`MaxPostedCmdBuffers > MPT_MAX_REQUESTS/2`, the array is smaller than the
checked bound; an ABTS with RX_ID in `[tgt_cmds_allocated, mpt_max_tgtcmds)`
reads an OOB pointer.

## Reproduce
1. Apply `fix.diff` to /usr/src.
2. `cd /usr/src/sys/dev/disk/mpt && make KMOD=mpt`  →  mpt.ko builds clean.
3. Runtime test requires FC HBA with `MaxPostedCmdBuffers > MPT_MAX_REQUESTS/2`
   + adjacent FC peer sending crafted ABTS (not present on this guest).

See `VERDICT.md` for the full analysis.