DF-4451 fix validation (2026-09-20, audit guest)

Baseline (unpatched):
  * Stock X86_64_GENERIC (INVARIANTS): boot panic
    "panic: link_add_crs: array boundary violation" with the crafted SSDT
    (see panic.txt) — the kernel's own assertion catches the overrun.
  * NOINV4451 (X86_64_GENERIC minus INVARIANTS = production-style):
    - v3 SSDT (8192 extra IRQ descriptors, ~850 KB overwrite walk):
      hard reset, no panic/DDB possible -> 16 crash-loop cycles captured in
      run-noinv-boot.log.
    - v2 SSDT (128 extra descriptors, ~13 KB overwrite): system boots and
      runs normally — the corruption is fully silent (run-noinv-128-stealth-boot.log).

Patched (fix.diff applied to guest /usr/src, kernel NOINV4451 rebuilt and
installed — see fix_build.log):
  * Same v3 SSDT: system boots cleanly to multiuser, pci_link5 (LNKX)
    attaches with its single counted link, and the new guard prints
    "_CRS returned more IRQ resources than counted" exactly 8191 times
    (8192 descriptors in the stateful _CRS minus the 1 that pl_num_links
    accounts for). No panic, no Fatal trap, no db> prompt.
    (fix_run.log, grep -c = 8191)

fix_status: fixed (baseline reproduced, patched behavior clean).