DF-4086 object-level proof (mps_mapping.c:221-235)
  facts: MaxTargets=0 MaxVolumes=255 -> max_devices=255
  valid mapping_table indices: 0..254
  IR maprange: start=1 end=255  (end == max_devices => OFF-BY-ONE: `<=` walks hit index 255)
  wwid walk  :366 read physical_id at mapping_table[255] -> OOB READ
  free-idx walk :457 returned 255 (== max_devices, OUT OF BOUNDS)
  event write: mapping_table[255] = {wwid 0x57119418badb00b5, handle 0x0b1d, info 0x30000000}
  guard[0].physical_id == fw WWID: 32-byte heap OOB WRITE at index max_devices
RESULT: OFF-BY-ONE OOB READ + CONDITIONAL OOB WRITE PROVEN
EXIT=0