=== Case 1: Intel parser (ata-raid.c:2132-2154) ===
  meta = kmalloc(1536); magic OK; config_size = 0x10000 (65536)
  loop reads 65536 bytes from a 1536-byte buffer -> 64000-byte OOB read
  magic check: PASS (matches INTEL_MAGIC)
  loop will run 16384 iterations, reading 65536 bytes (buffer = 1536 bytes -> 64000-byte OOB read)
  (loop completed without SIGSEGV -- in the kernel this would have consumed kmalloc trailing bytes = info leak)

=== Case 2: nVidia parser (ata-raid.c:3028-3048) ===
  meta = kmalloc(sizeof(nvidia_raid_conf)=512); magic OK; config_size = 0x400 (1024)
  loop reads 1024 u32 words = 4096 bytes from a 512-byte buffer -> 3584-byte OOB read
  magic check: PASS (matches NV_MAGIC)
  loop will run 1024 iterations, reading 4096 bytes (buffer = 512 bytes -> 3584-byte OOB read)
  (loop completed without SIGSEGV -- kernel equivalent: info leak of slab trailing bytes)

DF-1175 harness: both OOB-read cases demonstrated.
  Impact ceiling: info leak (small over-read) + DoS panic (large over-read).
EXIT=0