DF-3693 supporting evidence: struct sizes compiled on the guest (cc 8.3,
DragonFly 6.5-DEVELOPMENT) from the packed definitions in
/usr/src/sys/dev/disk/nata/ata-raid.h:

$ ./layout2
sizeof adaptec=8704 magic_3@8448 configs@64 cfg0.total_disks@64 cfg0.type@73 cfg0.stripe_shift@92 cfg0.sectors@88 cfg0.magic_0@68 gen@4
sizeof promise=2048 raid@512 raid.integrity@512 raid.disk_number@517 raid.disk_sectors@532 raid.generation@540 raid.status@542 raid.type@543 raid.total_disks@544 raid.stripe_shift@545 raid.array_width@546 raid.total_sectors@548 raid.disk@564 checksum@2044
sizeof hptv2=512

=> kmalloc'd hptv2 buffer: 512 bytes
=> write length passed to ata_raid_rw: sizeof(struct promise_raid_conf) = 2048 bytes
=> OOB read span persisted to disk: 2048 - 512 = 1536 bytes of adjacent kernel heap

Parser gating (sys/dev/disk/nata/ata-raid.c):
1407 ata_raid_read_metadata(...)
1414     if (devclass == pci_devclass || devclass == atapci_devclass) {
1415         switch (pci_get_vendor(GRANDPARENT(device_get_parent(subdisk)))) {
1416         case ATA_HIGHPOINT_ID:
1417             if (ata_raid_hptv3_read_meta(subdisk, ata_raid_arrays))
1418                 return 0;
1419             if (ata_raid_hptv2_read_meta(subdisk, ata_raid_arrays))
1420                 return 0;

=> HPTv2 format requires a HighPoint PCI vendor; this guest (Intel PIIX3)
   cannot instantiate AR_F_HPTV2_RAID, so the writeback path cannot be
   exercised on this hardware. Source analysis stands on its own.

Writeback triggers:
  912  ata_raid_config_changed(rdp, writeback)
  977      if (rdp->status != status) { writeback = 1; ...
  997      if (writeback) ata_raid_write_metadata(rdp);
 1487      switch (rdp->format) {
 1492          case AR_F_HPTV3_RAID:
 1493          case AR_F_HPTV2_RAID:
 1498              return ata_raid_hptv2_write_meta(rdp);
 4179          ata_raid_config_changed(ars->raid[volume], 1);   /* subdisk detach */