sizeof(struct mrsas_iocpacket)=404 (kernel packed: 400)
[arm 1] race at the validation->use boundary (:186 check vs :225 loop)
  -> SIGSEGV at guard page: ioctl_data_tag[i]/ioctl_data_mem[i] written OUT OF BOUNDS, i ran toward 0x20000
  canary: first OOB slot=16 (byte +0 past the 16-entry arrays), last=591

[arm 2] wide window: flip during firmware command; copyout loop (:307) — deterministic
  copyout loop (:307) with raced sge_count=24:
    copyout(ioctl_data_mem[16] = 0xfffff00012345688  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[17] = 0xfffff00012345689  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[18] = 0xfffff0001234568a  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[19] = 0xfffff0001234568b  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[20] = 0xfffff0001234568c  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[21] = 0xfffff0001234568d  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[22] = 0xfffff0001234568e  /* kernel stack value */, user iov_base, iov_len)
    copyout(ioctl_data_mem[23] = 0xfffff0001234568f  /* kernel stack value */, user iov_base, iov_len)

[arm 3] FIXED model: kernel copy of the packet (copyin at entry)
  loops stayed in [0,16): clean exit; writes past arrays: none
EXIT=0