===== TEST 1 =====
== DF-2494 test1: production parse with raid_number=29 (deterministic; configs[29] is the last in-bounds entry) ==
raidp base=0xffffffff826035c0, logical array = 16 slots / 128 bytes, ends at 0xffffffff82603640
raidp[0+29] = 0xffffffff826036a8 = 104 bytes PAST the end of the 16-entry array
before: witness[29] = 0
ata_raid_lsiv2_read_meta() returned 1
after:  witness[29] = 0xfffff80116973700   (CHANGED -- production code kmalloc()d an ar_softc and stored the pointer OUT OF BOUNDS)
PROOF: the production parser wrote a kernel heap pointer at raidp[0+29], 104 bytes past the end of the 16-entry array (no bounds check on array + meta->raid_number, ata-raid.c:2802-2806)

===== TEST 2 =====
== DF-2494 test2: production parse with raid_number=16 (FIRST out-of-bounds slot; deterministic) ==
raidp[0+16] = 0xffffffff82603640 = first 8 bytes past the 16-entry array (in the guest kernel this exact slot is &atapi_cam_devclass, nm: ata_raid_arrays=0xffffffff8114dec0 + 128)
before: witness[16] = 0
ata_raid_lsiv2_read_meta() returned 1 (array accepted)
after:  witness[16] = 0xfffff80116972300   (CHANGED -- OOB write, slot RETAINS the pointer (no cleanup on the accepted-type path))

===== TEST 4 =====
== DF-2494 test4 (corroboration): disk_number=49 heap OOB in the same parse (disks[16] is the first OOB index) ==
parse rc=1 raidp[0]=0xfffff8011696d300 sizeof(struct ar_softc)=2424
&rdp->disks[0] - rdp = 112; &rdp->disks[49] - rdp = 2464; object size = 2424 -> OUT OF BOUNDS by 40 bytes
readback of the OOB-written entry (behind the object): dev=0xffffffff82603460 sectors=0 flags=0xb (AR_DF_ONLINE|PRESENT|ASSIGNED=0xb)