== DF-4560: unvalidated fixed-offset event-member reads (mps_sas_lsi.c:273,276-279,515,518) ==

allocation: sz = EventDataLength*4 bytes (mps_sas_lsi.c:140-141)
IR  sink needs >= 12 B (Flags@4..8 + VolDevHandle@10..12)
LOG sink needs >= 21 B (Qualifier@14..16 + LogData[0]@20..21)

-- IR CONFIG CHANGE LIST: element->VolDevHandle read at +0x0A --
  [IR  EDL=2] SIGSEGV — OOB read past the EventDataLength-sized allocation (expected)
  [IR  EDL=3] clean — in bounds (expected)
-- LOG ENTRY ADDED: LogData[0] read at +0x14 --
  [LOG EDL=1] SIGSEGV — OOB read past the EventDataLength-sized allocation (expected)
  [LOG EDL=4] SIGSEGV — OOB read past the EventDataLength-sized allocation (expected)
  [LOG EDL=6] clean — in bounds (expected)

-- arithmetic table (no deref) --
    EDL=0: alloc= 0 B | IR VolDevHandle@10 OOB | LOG Qualifier@14 OOB | LOG LogData@20 OOB
    EDL=1: alloc= 4 B | IR VolDevHandle@10 OOB | LOG Qualifier@14 OOB | LOG LogData@20 OOB
    EDL=2: alloc= 8 B | IR VolDevHandle@10 OOB | LOG Qualifier@14 OOB | LOG LogData@20 OOB
    EDL=3: alloc=12 B | IR VolDevHandle@10 ok  | LOG Qualifier@14 OOB | LOG LogData@20 OOB
    EDL=4: alloc=16 B | IR VolDevHandle@10 ok  | LOG Qualifier@14 ok  | LOG LogData@20 OOB
    EDL=5: alloc=20 B | IR VolDevHandle@10 ok  | LOG Qualifier@14 ok  | LOG LogData@20 OOB
    EDL=6: alloc=24 B | IR VolDevHandle@10 ok  | LOG Qualifier@14 ok  | LOG LogData@20 ok 

-- DF-4561 arithmetic: mpssas_ir_shutdown volume scan coverage (mps_sas_lsi.c:902-911) --
    IR range [256..263] (8 slots); loop visits 7, last visited 262 -> slot 263 (the LAST volume slot) NEVER checked for a volume before deciding whether to send SYSTEM_SHUTDOWN_INITIATED
== 5 cases, 3 confirmed OOB ==