===== FIXED-KERNEL TEST 1 =====
== DF-2494 test1: production parse with raid_number=29 (deterministic; configs[29] is the last in-bounds entry) ==
raidp base=0xffffffff82603bc0, logical array = 16 slots / 128 bytes, ends at 0xffffffff82603c40
raidp[0+29] = 0xffffffff82603ca8 = 104 bytes PAST the end of the 16-entry array
before: witness[29] = 0
ata_raid_lsiv2_read_meta() returned 0
after:  witness[29] = 0   (unchanged)
PROOF: the production parser wrote a kernel heap pointer at raidp[0+29], 104 bytes past the end of the 16-entry array (no bounds check on array + meta->raid_number, ata-raid.c:2802-2806)

===== FIXED-KERNEL TEST 2 =====
== DF-2494 test2: production parse with raid_number=16 (FIRST out-of-bounds slot; deterministic) ==
raidp[0+16] = 0xffffffff82603c40 = first 8 bytes past the 16-entry array (in the guest kernel this exact slot is &atapi_cam_devclass, nm: ata_raid_arrays=0xffffffff8114dec0 + 128)
before: witness[16] = 0
ata_raid_lsiv2_read_meta() returned 0 (array accepted)
after:  witness[16] = 0   (unchanged)

===== FIXED-KERNEL TEST 3 =====
== DF-2495 test3: disk_count=255 -> production ata_raid_status() OOB write ==
parse rc=0: raidp[0]=0 rdp->total_disks=0 (MAX_DISKS=16, ata-raid.c:2856 takes disk_count verbatim)
parse failed, cannot run status