# DF-3929 — mly: `mly_done()` completion slot lacks lower-bound check → `mly_command[-1]` OOB write + TAILQ pointer writes

## Build / Run
Triggered purely by the controller's completion traffic (hardware mailbox
status register read or memory-mailbox status ring walk).  On hardware, a
card returning command_id 0 in a completion (buggy/hostile firmware) hits it
from the very first interrupt — no user action required beyond having the
driver attached.

Lab observation: QEMU device model returning status_mailbox value 0x0000 (or
an mmbox status entry with command_id=0) → immediate OOB write on completion.

## Expected result
`mc = &sc->mly_command[0 - MLY_SLOT_START]` = `mly_command[-1]` — three direct
field writes plus `TAILQ_REMOVE()` pointer writes into the tail of `mly_btl[]`,
then the fake command is threaded onto the complete queue and its
`mc_complete` (garbage from controller-fed btl fields) is called.

Hardware-gated (no mly controller in the audit guest): source-certain.
See VERDICT.md.