-> pid        @ 1320

== attacker sets map->total_disks = 255 ==
loop writes raid->disks[0..254]; valid range is [0..15]
OOB entries written past disks[15]: 239
OOB bytes written past disks[15]:   11472  (=239 * 48)
  of which INSIDE ar_softc struct : 448 bytes (clobbers toggle/rebuild_lba/lock/disk/devstat/cdev/pid)
  of which PAST the struct boundary: 11024 bytes (into adjacent kernel heap)

first OOB write lands at struct offset 880 == ar_softc.toggle (then rebuild_lba, lock, disk, devstat, cdev, pid, then heap)

Per OOB entry, attacker-controlled bytes:
  serial[16] (16) + sectors (8) = 24 of 48 bytes attacker-shaped; dev/last_lba/flags also written (NULL/0/0 by the loop)
RESULT: OOB heap write CONFIRMED — 11472 bytes past disks[15] for total_disks=255