[DF-1284] psg[17] in BUS_DMAMAP, sizeof(SCAT_GATH)=16, psg spans bytes 0..272
[DF-1284] attacker sglist_cnt=64 (max allowed for psg[]=17)
[DF-1284] overflow past psg[17]: YES (47 guard entries clobbered; 752 bytes of adjacent heap overwritten)

--- Fix demonstration ---
[DF-1284] FIX: clamp/REJECT sglist_cnt=64 > MAX_SG_DESCRIPTORS=17 -> no overflow
RUN_EXIT=0