=== DF-1172 struct layout (faithful, LP64) ===
sizeof(struct ar_disk)          = 48
sizeof(struct ar_softc_prefix)  = 880
offsetof disks[0]               = 112
offsetof disks[16] (first OOB)  = 880
MAX_ARRAYS=16  MAX_DISKS=16  configs[30]

BUG 1 (ata-raid.c:2802-2803): raidp[array+200] over 16 array iters
   -> 16 BSS-OOB pointer stores into ata_raid_arrays[16..], worst idx=215
   -> 1600 bytes past the 16-slot array (worst), clobbering adjacent BSS

BUG 2 (ata-raid.c:2818-2822): configs[200] (configs[30]) -> OOB READ (CWE-125)

BUG 3 (ata-raid.c:2866-2869): raid->disks[200] (disks[16])
   -> 240 OOB ar_disk entries (each 48 B) = 11520 total OOB bytes
   -> ~436 bytes clobber trailing ar_softc fields, ~8444 bytes spill into adjacent heap

DF-1172: CONFIRMED 3-site OOB in ata_raid_lsiv2_read_meta (raid_number=200, disk_number=200)

--- WITH FIX (reject if raid_number>=MAX_ARRAYS || disk_number>=MAX_DISKS) ---
metadata REJECTED -> loop never runs
BSS-OOB stores=0 ; configs OOB=0 ; disks OOB=0 (all expect 0)
DF-1172 FIX: VALIDATED - range rejection eliminates all 3 OOB sites
RUN_EXIT=0