psrb_pool entries      : 384 (valid SMID range 0..383)
cmdSMID field width    : 16 bit (0..65535), DMA-written by firmware, unvalidated

SMID=100    -> in-bounds read, srb=0xdead0064 (0xdead0064) OK

SMID=0xffff (65535)
  index distance past array end: 65152 entries (521216 bytes)
  OOB slot read yields  : 0x410660  (value from adjacent kernel memory, e.g. 0xA5A5A5A5A5A5A5A5)
  then arcmsr.c:829 dereferences srb->acb -> wild pointer dereference (kernel panic)

(A-D variant) raw device value 0xedcba988 -> srb=0xfffffe004321e980
  distance from pool base: +0x41fea980 bytes (pool is only ~209KB)

required guard (absent at arcmsr.c:821 / :3582):
    if (flag_srb >= ARCMSR_MAX_FREESRB_NUM) return;

[+] DF-3709 CONFIRMED: firmware SMID 0xffff indexes 65152 entries past the 384-entry psrb_pool -- OOB kernel read feeding a pointer dereference.
RUN_EXIT=0