# DF-1375 — _mapping_add_new_device slot underflow OOB write (mps)

## Summary
`_mapping_add_new_device` (`sys/dev/raid/mps/mps_mapping.c:1165`) computes
`map_idx = start_index + slot - start_slot` with no check that
`slot >= start_slot`; a firmware slot below `start_slot` wraps the `u32` to
~0xFFFFFFFF → `mapping_table[~0xFFFFFFFF]` massive OOB write. The reservation
loop at `:992-998` also trusts firmware `num_slots` without a bounds check. Twin
of DF-1283 (mpr). No SAS HBA on the audit guest.

## Reproduce
```
./build.sh   # cc -O2 -o harness harness.c
./run.sh     # ./harness
```
Expected: `map_idx = 4294967294 (0xfffffffe) ... massive OOB write`,
`wrote attacker data into mapping_table[7] ... wrong-target corruption`,
`reservation loop ... 850 > max_devices=264 -> OOB write`. Object-level proof —
mps cannot attach on the QEMU guest.

## Fix
`fix.diff` validates `slot >= start_slot`, `map_idx < max_devices`, and
`map_idx + num_slots <= max_devices`. Validated to apply + compile (`mps.ko`,
clean build rc=0).