DF-4092 object-level proof (mpr_mapping.c:2216,2284-2347)
  sizeof(dev_mapping_table) : 32 (expect 32 on amd64)
  max_devices               : 510 (kmalloc 16320 bytes, :2140)
  MaxNumPhysicalMappedIDs   : 0xffff (IOC pg8, unvalidated)
  DPM entry 0               : dev_idx=256 (in bounds!), num_slots=65535
  scenario A (cold garbage)  : wrote 254 entries [256,510), conflict gate: TRIPPED at first OOB block (goto fail :2336)
  scenario B (0xFFFF groom)  : wrote 4350 entries, 4096 of them PAST the table
  reservation loop wrote     : [256, 4606)  (table ends at 510)
  kernel equivalent          : 131072-byte heap write of fw-controlled data
    past a 16320-byte kmalloc, attacker qword 0x5141524153534141 at stride 32
  scenario C (all 0xFFFF)    : 65281 entries past table = 2088992 bytes linear smash
RESULT: OOB WRITE PRIMITIVE PROVEN (canary smash at stride 32; per-entry dpm_entry_num==BAD_IDX gate modeled verbatim)