DF-1172 (nataraid ata-raid.c LSI v2 parser) — fix validation (combined nativekernel build)
=========================================================================================
Baseline (#0 unpatched):  ata_raid_lsiv2_read_meta indexes raidp[array+meta->raid_number]
   (ata-raid.c:2802-2803, BSS OOB of heap ptr for raid_number>=16),
   meta->configs[raid_number] (:2819/2822, OOB read for raid_number>=30), and
   raid->disks[meta->disk_number] (:2866-2869, heap OOB for disk_number>=16).
   => 3-site OOB (BSS write + configs OOB read + heap overflow). CONFIRMED by
     overflow_harness (1600 B BSS spill worst-case, configs[200] OOB read,
     11520 B heap spill for disk_number=200). nataraid IS in X86_64_GENERIC:83
     and the guest's Intel PIIX4 IDE controller passes the read_metadata gate.

Fix (#1 single-fix kernel, both wpi+nata fixes applied together):
   cd /usr/src && patch -p1 --forward < /root/df1172.diff   -> Hunk #1 @2795 OK
   make -j6 nativekernel KERNCONF=X86_64_GENERIC            -> NK_DONE rc=0
   ata-raid.o compiled clean under -Werror.
   cp kernel.stripped /boot/kernel/kernel ; boot
   kern.version = DragonFly 6.5-DEVELOPMENT #1: Fri Jul 17 06:10:36 UTC 2026
   Rejection-guard string present in booted kernel:
     strings /boot/kernel/kernel | grep -c "raid_number %u / disk_number %u out of range" -> 1

Before/after marker (harness, same math as the live parser):
   BEFORE (#0): 3-site OOB confirmed (BSS 16 stores / configs[200] / disks 240 entries).
   AFTER  (#1): metadata with raid_number>=16 or disk_number>=16 is REJECTED before
                the loop runs -> 0 BSS-OOB stores, 0 configs OOB, 0 disks OOB
                (overflow_harness WITH-FIX section).

fix_status: not_testable (runtime) — the live in-kernel trigger requires an ATA
   disk carrying crafted LSI v2 metadata; the QEMU/loader artifact documented in
   DF-1171 (the DragonFly loader hangs on ANY extra hard disk before the kernel
   boots) blocks adding such a disk on this guest. Validated at apply + compile +
   boot + harness level: the range-rejection guard is compiled into the booted
   #1 kernel and provably prevents all 3 OOB indexings.