SCENARIO guard: desc at page+4088, bLength=8, bNrInPins=3, d1 lands at offset 8 (== bLength)
SCENARIO guard: byte at offset 8 is the first byte of the PROT_NONE page -> expect SIGSEGV now
SCENARIO guard: SIGSEGV si_addr=0x800474000  (1-byte OOB read of d1->bNrChannels past bLength hit the guard page)
91