== DF-4559: sassc->targets[] OOB write (mps_sas_lsi.c volume registration vs mps_sas.c:697 alloc) ==
facts: MaxTargets=256 MaxVolumes=8 -> targets n=256 entries (51200 B); ID space max_devices=264 (0..263)

  sizeof(struct mpssas_target) [replica, x86-64] = 200
  offsetof: handle=0 linkrate=2 devname=8 tid=26 commands=40 luns=32 timedout=64
  [informational] MaxTargets=65535 MaxVolumes=255 -> sc->max_devices truncates to 254 (< max_volumes=255); ir_shutdown start_idx = max_devices - max_volumes = 4294967295 (u32 wrap) -> &sc->mapping_table[0xffffffff] wild read (mps_sas_lsi.c:901-905)

-- guarded (array end == guard page start) --
  [voladd-HIGH ] -> KILLED by SIGSEGV at write past allocation end (OOB write confirmed)
  [voladd-LOW  ] -> clean exit (all writes in bounds)
  [removed-HIGH] -> KILLED by SIGSEGV at write past allocation end (OOB write confirmed)
  [voladd-HIGH-FIXED] -> clean exit (all writes in bounds)

-- canary (corruption footprint) --
    volume id 256: writes span bytes [51200..51400) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +51208)
    volume id 257: writes span bytes [51400..51600) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +51408)
    volume id 258: writes span bytes [51600..51800) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +51608)
    volume id 259: writes span bytes [51800..52000) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +51808)
    volume id 260: writes span bytes [52000..52200) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +52008)
    volume id 261: writes span bytes [52200..52400) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +52208)
    volume id 262: writes span bytes [52400..52600) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +52408)
    volume id 263: writes span bytes [52600..52800) rel. to array base — PAST END (offsetof devname=8, wwid u64 lands at +52608)
    canary result: 416 bytes clobbered past the allocation end, spanning [+51200 .. +52679] (allocation was 51200 bytes)
    devname readback at first volume slot: 0xdeadbeefcafe0609 (expected 0xdeadbeefcafe0609) -> MATCH: fw-controlled 8B OOB write