harness.c: In function 'emulate_nvidia_parser.isra.1':
harness.c:102:20: warning: array subscript 16 is above array bounds of 'struct ar_disk[16]' [-Warray-bounds]
         raid->disks[disk_number].dev    = (void *)0xdeadbeef; /* parent      */
         ~~~~~~~~~~~^~~~~~~~~~~~~
harness.c:103:20: warning: array subscript 16 is above array bounds of 'struct ar_disk[16]' [-Warray-bounds]
         raid->disks[disk_number].sectors= 0x4141414141414141ULL;
         ~~~~~~~~~~~^~~~~~~~~~~~~
harness.c:104:20: warning: array subscript 16 is above array bounds of 'struct ar_disk[16]' [-Warray-bounds]
         raid->disks[disk_number].flags  = 0x000f;
         ~~~~~~~~~~~^~~~~~~~~~~~~
BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  9224 Jul 17 06:46 harness
----- RUN -----
=== DF-1173: ar_softc.disks[16] OOB write (nataraid) ===
sizeof(ar_disk)=48  sizeof(ar_softc)=912
offset disks[0]=48  disks[16]=816  past-array=816
[*] nVidia parser: disk_number = meta->disk_number = 3 (MAX_DISKS=16)
[+] in-bounds (disk_number=3) -- benign

[*] nVidia parser: disk_number = meta->disk_number = 200 (MAX_DISKS=16)
[!] OOB WRITE: raid->disks[200] is 9600 bytes past disks[0]
[!] 8832 bytes PAST disks[15] into the post-array region
[!] write begins inside: ?
[!] emulated raid->disks[200].{dev,sectors,flags} writes -- OOB landed in ?

[*] HPTv2 RAID01 path: disk_number = meta->disk_number(250) + meta->array_width(250) = 500
[!] => disks[500] write, 24000 bytes past disks[0]

[+] DF-1173 OOB CONFIRMED: disk_number (u8) used as disks[16] index with no bounds check.
RUN_EXIT=0