=== DF-2315 FIX VALIDATION RUN (fixed kernel: both pnp.c fixes applied
    DragonFly 6.5-DEVELOPMENT #6: Sun Oct 18 16:13:52 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/PNPH)
=== fix applied in guest /usr/src (verified) ===
2 quirk guards: `if (qp->arg1 != 0 && config->ic_nport < ISA_NPORT) {` (and arg2)
1 trim guard (DF-2314, unrelated to these scenarios)

--- scenario 4: direct, ic_nport=49 ---
== scenario 4 rc=0
  nport: before=49 after=0x32(50)
  irqmask before/after: {0xcafe0001,0xcafe0002} -> {0xcafe0001,0xcafe0002}
  drqmask before/after: {0xcafe0003,0xcafe0004} -> {0xcafe0003,0xcafe0004}
  counters(nmem,nport,nirq,ndrq) after : {0xc0ffee,0x32,0xc0fff0,0xc0fff1}
    [BASELINE: nport=51, masks overwritten {0xa20,0xa2f}/{0x10,0x10}]
    -> arg1 applied legally (port[49], nport 49->50); arg2 BLOCKED (nport==50).
       ALL canaries intact.

--- scenario 5: direct, ic_nport=50 ---
== scenario 5 rc=0
  nport: before=50 after=0x32(50)
  irqmask before/after: {0xcafe0001,0xcafe0002} -> {0xcafe0001,0xcafe0002}
  drqmask before/after: {0xcafe0003,0xcafe0004} -> {0xcafe0003,0xcafe0004}
  counters(nmem,nport,nirq,ndrq) after : {0xc0ffee,0x32,0xc0fff0,0xc0fff1}
    [BASELINE: nport=0xa2f(2607), masks={0x620,0x62f}, counters={0xa20,0xa2f,0x10,0x10}]
    -> BOTH quirk writes blocked; nothing aliased; counters sane.

--- scenarios 6/7/8: real pnp_parse_resources, 17 / 18 / 200 IO tags ---
== scenario 6 rc=0
  nport: before=0 after=0x32(50); irqmask {0,0}->{0,0}; drqmask {0,0}->{0,0}; cnt {0,0x32,0,0}
== scenario 7 rc=0
  nport: before=0 after=0x32(50); irqmask {0,0}->{0,0}; drqmask {0,0}->{0,0}; cnt {0,0x32,0,0}
== scenario 8 200 rc=0
  nport: before=0 after=0x32(50); irqmask {0,0}->{0,0}; drqmask {0,0}->{0,0}; cnt {0,0x32,0,0}
    [BASELINE 17: irq={0xa20,0xa2f} drq={0x10,0x10} nport=51;
     BASELINE 18: cnt={0x220,0x36,0x10,0x10};
     BASELINE 200: cnt={0x220,0x258,0x10,0x10} + writes past the 8640-byte alloc]
    -> stored ice_config is CLEAN at every tag count: the quirk stops adding
       ports at ISA_NPORT; no aliasing, no counter clobber, no heap escape.
       (The stored masks stay 0 = the M_ZERO initialization: no port data ever
       leaks into them again.)

VERDICT: baseline symptoms (ic_port[50] -> irq/drq mask aliasing,
ic_port[51] -> counter clobber including ic_nport=2607, corrupted config
escaping into the device, heap-escape arithmetic at 200 tags) fully
eliminated by the two `&& config->ic_nport < ISA_NPORT` guards; the legal
extra-port behavior (arg1 applied while room remains) still works.