BUILD_EXIT=0
=== DF-1737 nata ATAPI byte-count OOB harness ===
request->bytecount = 4096, data buffer = 4096 bytes
transfersize (max PIO) = 65536 bytes

[IRQ 0] device reports length=4096 bytes
   after IRQ: donecount=4096, next transfersize=min(bytecount-donecount=0, ts) = 0
[IRQ 1] device reports length=8192 bytes
   PIO write at data[4096] = +1 past buffer end (OOB)
   PIO write at data[4097] = +2 past buffer end (OOB)
   PIO write at data[4098] = +3 past buffer end (OOB)
   PIO write at data[4099] = +4 past buffer end (OOB)
   PIO write at data[4100] = +5 past buffer end (OOB)
   PIO write at data[4101] = +6 past buffer end (OOB)
   PIO write at data[4102] = +7 past buffer end (OOB)
   PIO write at data[4103] = +8 past buffer end (OOB)
   PIO write at data[4104] = +9 past buffer end (OOB)
   PIO write at data[4105] = +10 past buffer end (OOB)
   PIO write at data[4106] = +11 past buffer end (OOB)
   PIO write at data[4107] = +12 past buffer end (OOB)
   PIO write at data[4108] = +13 past buffer end (OOB)
   PIO write at data[4109] = +14 past buffer end (OOB)
   PIO write at data[4110] = +15 past buffer end (OOB)
   PIO write at data[4111] = +16 past buffer end (OOB)
   after IRQ: donecount=12288, next transfersize=min(bytecount-donecount=4294959104, ts) = 65536  (wrap: ~4 GB)

VERDICT: BUG CONFIRMED. Device-reported length is never bounded to
        bytecount-donecount. A malicious ATAPI device can advance
        donecount past request->data and then PIO-write up to 64 KB
        of attacker-controlled bytes into adjacent kernel heap.
RUN_EXIT=0