BUILD-OK
sizeof(I2O_MESSAGE_FRAME)                 = 12 (expect 12)
offsetof(...SCB_EXECUTE, SGL)             = 48 (expect 48)
sizeof(I2O_SGE_SIMPLE_ELEMENT)            = 8 (expect 8)
asr_action stack buffer `struct Message'  = 512 bytes
loop writes SGL elements [0..57] -> max offset 511
sense element after a FULL loop lands at  [512, 520)
overflow past the 512-byte buffer: 8 bytes
=> a single XPT_SCSI_IO whose data spans >= 58 physical runs
   (>= 232 KiB with 4K pages) drives the mandatory sense
   element write out of bounds.  Buffer-cache I/O is capped
   by MAXPHYS=128KiB (~33 runs); CAM pass-through is not.