== baseline rig build (unfixed /usr/src, guest, root) ==
$ cd /root/dfrig && make
cc -O2 -pipe -I/usr/src/sys/dev/disk/nata -I/usr/obj/usr/src/sys/X86_64_GENERIC -I/root/dfrig -I/sys -Wall -Wno-error=unused-variable -Wno-error=unused-function -Wno-error=array-bounds -D_KERNEL ... -c dfrig_ata.c
In file included from /usr/src/sys/dev/disk/nata/ata-raid.c:78:
dfrig_ata.c:201:9: warning: array subscript 255 is above array bounds of 'struct ar_softc *[16]' [-Warray-bounds]
   (the rig intentionally addresses raidp[] past its 16-entry bound -- that
    is the bug under test; the warning is suppressed from -Werror and kept
    here as build-time evidence that the OOB addressing is real)
cc -Wl,--build-id=sha1 -nostdlib -Wl,--hash-style=sysv -r -Wl,-d -o dfrig_ata.ko dfrig_ata.o
== rig module: dfrig_ata.ko (production sys/dev/disk/nata/ata-raid.c #included verbatim, module plumbing neutralized, ata_queue_request interposed as the disk-I/O seam) ==