== DF-2494 fix validation: single-fix kernel (DragonFly 6.5-DEVELOPMENT #1:
   Mon Oct 12 11:14:44 UTC 2026, fix.diff applied to /usr/src, nativekernel
   + installkernel + reboot), rig rebuilt against the FIXED production source ==
$ sysctl kern.dfrig_ata_test=1     # raid_number=29
== DF-2494 test1: production parse with raid_number=29 (deterministic; configs[29] is the last in-bounds entry) ==
raidp base=0xffffffff82603bc0, logical array = 16 slots / 128 bytes, ends at 0xffffffff82603c40
raidp[0+29] = 0xffffffff82603ca8 = 104 bytes PAST the end of the 16-entry array
before: witness[29] = 0
ata_raid_lsiv2_read_meta() returned 0            <-- FIX: parse rejects (was 1)
after:  witness[29] = 0   (unchanged)            <-- FIX: no OOB store (was heap ptr)

$ sysctl kern.dfrig_ata_test=2     # raid_number=16
== DF-2494 test2 ... ==
before: witness[16] = 0
ata_raid_lsiv2_read_meta() returned 0            <-- FIX: rejected (was 1, accepted)
after:  witness[16] = 0   (unchanged)            <-- FIX: slot untouched (was heap ptr)

$ sysctl kern.dfrig_ata_test=6     # raidp = REAL kernel ata_raid_arrays
== DF-2494 test6 ... ==
before: raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0 0
parse rc=0                                       <-- FIX: rejected (was 1)
after:  raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0 0
                                                 <-- FIX: REAL kernel BSS unchanged
                                                 (baseline run B planted/used a pointer
                                                  at raidp[20] and wrote fields into
                                                  the heap object it pointed to)

$ nm /boot/kernel/kernel | grep -w ata_raid_arrays
ffffffff8114dec0 b ata_raid_arrays               <-- unchanged symbol/address