== BEFORE-FIX (vulnerable) ==
BUG: event_buf_size=256, bzero(&event_bufs[0], 256) writes 256-16=240 bytes past slot
     bzero of all 4 slots spills 4*256=1024 bytes past event_bufs[] into softc/heap
     4 slots overflow their boundaries; sglist_append(event, 256) likewise over-describes for DMA
== AFTER-FIX ==
FIX: event_buf_size clamped to sizeof(struct virtio_scsi_event)=16, no overflow