# DF-4766 — non-NUL-terminated `arrayname[16]` printed with `%s` → kernel stack overread in world-readable sysctl

File: `sys/dev/raid/hptmv/hptproc.c` (pass 2)

    ./build.sh
    kldload /root/h1/h1harness.ko
    sysctl h1harness.trigger=3      # baseline: 17-char row (overread)
    sysctl h1harness.trigger=6      # fix.diff applied: exactly 16 chars

Baseline (run.log): `Channel 1  A  953883MB  Normal   NNNNNNNNNNNNNNNA`
— the 17th char is stack data read past `arrayname[16]`.

Root cause: `hptproc.c:388` memcpy's `MAX_ARRAY_NAME`(16) bytes of
`ArrayName` (UCHAR[16], array.h:95 — nothing guarantees a terminator; the
on-disk config field at array.h:146 is copied verbatim) into
`char arrayname[16]` (hptproc.c:375) and prints it with `%s`
(hptproc.c:396) to any local user reading `sysctl hptmv.status`.

Same class in the same file: `hpt_copy_array_info` prints
`pArray->u.array.ArrayName` with `%-20s` (hptproc.c:477) — reads past the
16-byte field within the VDevice when unterminated (bounded by the first
zero byte in adjacent struct memory).

Fix: `fix.diff` F3 (size to `MAX_ARRAY_NAME+1` + force termination).
Validated in-harness (trigger 6).