DF-4093 object-level proof (mpr_mapping.c:241-255)
  sizeof(dev_mapping_table) : 32 (expect 32 on amd64)
  facts: MaxTargets=0 MaxVolumes=255 -> max_devices=255 (:2565)
  valid mapping_table indices: 0..254 (kmalloc 8160 bytes :2140)
  IR maprange: start=1 end=255  (end == max_devices => OFF-BY-ONE: `<=` walks hit index 255)
  wwid walk :387 read physical_id at mapping_table[255] -> OOB READ
  free-idx walk :484 returned 255 (== max_devices, OUT OF BOUNDS)
  event write: mapping_table[255] = {wwid 0x57119418badb00b5, handle 0x0b1d, info 0x30000000}
  guard[255].physical_id == fw WWID: 32-byte heap OOB WRITE at index max_devices
  DPM volume branch :2261 accepted DeviceIndex 255 == end_idx -> second 32-byte OOB WRITE
RESULT: OFF-BY-ONE OOB READS + TWO 32-BYTE OOB WRITES PROVEN