sizeof(MR_FW_RAID_MAP)      = 12936 (header comment says 0x3288=12936)
sizeof(MR_LD_SPAN_MAP)      = 2528 (header comment says 0x9E0=2528)
sizeof(MR_FW_RAID_MAP_ALL)  = 172200
sizeof(MR_LD_TARGET_SYNC)   = 4
map_sz (mrsas.c:1645)       = 172200  <- bus_dmamem_alloc size
capacity in sync entries    = 43050  (max ldCount before OOB)

Firmware supplies ldCount=65536, totalSize=0x9e028a8:
  MR_ValidateMapInfo: totalSize(0x9e028a8) == expected(0x9e028a8) -> PASSES
  mrsas_sync_map_info loop writes 65536 * 4 = 262144 bytes into a 172200-byte buffer
  => 89944 bytes written PAST the end of the DMA allocation
  => 22486 entries land fully out of bounds, each entry =
     { targetId: FW u8, reserved: 0x00, seqNum: FW u16 }

read side: MR_LdRaidGet(i)/MR_GetLDTgtId(i) read ldSpanMap[i] for
  i up to 65535; buffer holds 68 span maps -> OOB read too

PROOF OK: loop length is firmware-controlled and unbounded; validation does not bound ldCount
harness_exit=0
--- module/hw presence ---
		80 pci/mrsas
no LSI/Avago PCI device present
no /dev/mrsas* nodes (driver not attached)