# DF-1374 — _mapping_process_dpm_pg0 DeviceIndex OOB write (mps)

## Summary
`_mapping_process_dpm_pg0` (`sys/dev/raid/mps/mps_mapping.c:1495`) reads
`dev_idx = le16toh(dpm_entry->DeviceIndex)` from firmware and indexes
`mapping_table[dev_idx]` on the Enc/Slot (`:1544`) and Device-Persistence
(`:1567`) paths **without** bounds-checking against `max_devices`. Only the IR
path (`:1497`) validates it. Twin of DF-1282 (mpr). No SAS HBA on the audit
guest.

## Reproduce
```
./build.sh   # cc -O2 -o harness harness.c
./run.sh     # ./harness
```
Expected: `BUG CONFIRMED: dev_idx=266 >= max_devices=264 ... 64 bytes PAST the
allocation`, `guard/slab region corrupted: YES (4 of 64 entries touched)`.
Object-level proof — mps cannot attach on the QEMU guest (no SAS HBA).

## Fix
`fix.diff` adds `dev_idx`/`num_slots` bounds checks before both unbounded
indexings. Validated to apply + compile (`mps.ko`, clean build rc=0).