sizeof(fcparam) replica (LOWER BOUND; real is larger): 69696

isp_nchan=1  kmalloc size >= 69696 bytes
  in_vpidx=  1 -> FCPARAM offset       69696 bytes -> OUT OF BOUNDS by 0
  in_vpidx= 52 -> FCPARAM offset     3624192 bytes -> OUT OF BOUNDS by 3554496
  in_vpidx=103 -> FCPARAM offset     7178688 bytes -> OUT OF BOUNDS by 7108992
  in_vpidx=154 -> FCPARAM offset    10733184 bytes -> OUT OF BOUNDS by 10663488
  in_vpidx=205 -> FCPARAM offset    14287680 bytes -> OUT OF BOUNDS by 14217984
  in_vpidx=255 (max uint8_t) -> offset 17772480 bytes past a 69696-byte block

isp_nchan=2  kmalloc size >= 139392 bytes
  in_vpidx=  1 -> FCPARAM offset       69696 bytes -> in bounds by -69696
  in_vpidx= 52 -> FCPARAM offset     3624192 bytes -> OUT OF BOUNDS by 3484800
  in_vpidx=103 -> FCPARAM offset     7178688 bytes -> OUT OF BOUNDS by 7039296
  in_vpidx=154 -> FCPARAM offset    10733184 bytes -> OUT OF BOUNDS by 10593792
  in_vpidx=205 -> FCPARAM offset    14287680 bytes -> OUT OF BOUNDS by 14148288
  in_vpidx=255 (max uint8_t) -> offset 17772480 bytes past a 139392-byte block

Writable via that OOB pointer (isp_library.c:2407-2497):
  fcp->isp_tgt_map[nphdl]      (read + write i+1)
  lp->portid = s_id            (write, remote-controlled)
  lp->port_wwn = ini           (write, remote-controlled 8B)
  lp->target_mode/handle/etc.
GUEST_BUILD_EXIT=0