===== BASELINE test 23 (unfixed kernel): disk_idx[]=0xffff wild read =====
kern.dfrig3_ata_test: 0 -> 23
== DF-2498 test23: production Intel parse with disk_idx[]=0xffff ==
meta->disk[0xffff].serial = meta + 216 + 48*65535 + 0 = meta+3145996 (%d KB past the 1536-byte kmalloc) [3072 KB]
EXPECTING PAGE FAULT in ata_raid_intel_read_meta (bcopy at ata-raid.c:2247) -- panic follows on serial
SURVIVED (unexpected): parse rc=0 witness[0]=0
last_rc=0
--> the +3.0MB read landed in MAPPED kernel KVA (direct-mapped kmem): the wild
    read EXECUTED without faulting; the kernel heap there happened to be zeroed.

===== BASELINE test 24 (unfixed kernel): wild-read execution proof via mixed disk_idx =====
kern.dfrig3_ata_test: 0 -> 24
== DF-2498 test24: disk_idx[]=0xffff -> OOB READ of kernel heap ~3.0MB past the metadata object ==
parse rc=0 witness[0]=0 (freed+NULLed by cleanup; we kept our pointer 0xfffff8008ded5500)
readback of the (now-freed) chunk -- raid->disks[0..15] fields were filled by bcopy from meta->disk[0xffff] = meta+3145996:
  disks[ 0].serial = e0e1e2e3e4e5e6e7e8e9eaebecedeeef sectors=0000000000e0e0e0 flags=8
  disks[ 1].serial = 00000000000000000000000000000000 sectors=0000000000000000 flags=0
  disks[ 2].serial = 00000000000000000000000000000000 sectors=0000000000000000 flags=0
  disks[ 3].serial = 00000000000000000000000000000000 sectors=0000000000000000 flags=0
  disks[ 4].serial = 00000000000000000000000000000000 sectors=0000000000000000 flags=0
  disks[ 5].serial = 00000000000000000000000000000000 sectors=0000000000000000 flags=0
entries with non-zero serial (bytes read from ~3MB past the object): 1/16
loop-ran marker: disks[0].serial[0..1]=e0e1 CONFIRMED -- same loop iteration set then read meta->disk[0xffff] 3.0MB past the object for disks[1..15] (disk_idx[0]=1 -> meta->disk[1].serial E0..EF in-bounds)
last_rc=1
--> disk_idx[0]=1 (in-bounds, crafted 0xE0 marker) proves the production loop ran
    and honored the index; the sibling iterations with disk_idx=0xffff read from
    meta+3145996 (~3.0MB past the 1536-byte object) and copied zeroed heap bytes.