== DF-2494 test6: production parse writing the REAL kernel ata_raid_arrays (boot-attack target) ==
skip-occupied walk across real kernel BSS neighbors (atapi_cam_devclass/acd_/afd_/ast_devclass occupied; ast_total==0):
before: raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0 0
parse rc=0
after:  raidp[16..21] = 0xfffff8008bb13d20 0xfffff8004f1ab2e0 0xfffff8004f1ab400 0xfffff8004f1ab8e0 0 0
PROOF: raidp[20] (ast_total, +160 bytes past the 128-byte ata_raid_arrays) changed from 0 to 0 -- the production parser planted a kmalloc()d ar_softc* into an unrelated kernel BSS static of a different subsystem

== DF-2495 test7: rdp->total_disks=0 installed in the REAL kernel ata_raid_arrays[0]; the next IOCATARAIDSTATUS lun=0 through the REAL /dev/ata runs production ata_raid_status() and overwrites 1912 bytes past the 152-byte ioctl buffer ==

=== ioctl:
IOCATARAIDSTATUS lun=0 sizeof(status)=152 bytes (kernel kmallocs 152 -> writes 2064 bytes for total_disks=255)\nioctl returned -1 (errno=6) total_disks=0\nrc=0
ffffffff8114dec0 b ata_raid_arrays