=== RUN DF-1891 2026-07-20T18:44:52Z ===
DF-1891: ata_ahci_chipinit (ata-ahci.c:101-103)
  AHCI CAP.NP = 0x1f -> 32 ports
  AHCI PI     = 0xffffffff -> flsl = 32
  ctlr->channels = 32 (NO upper bound vs interrupt[8])
  OOB interrupt[] writes = 24 entries x 8 bytes = 192 bytes past interrupt[8] into the controller struct
  Harness: simulated writes touched 24 trailer words (function pointers in real kernel)
  On real HW: ata_generic_intr (ata-pci.c:584-586) later CALLS through these corrupted pointers on every IRQ -> arbitrary kernel code exec.
[exit=0]