DF-4875 arithmetic proof — afd_describe() sizestring[16] overflow
path1 READ_CAPACITY  (atapi-fd.c:384): mediasize=(u64)cap*blocksize, cap=blocksize=0xFFFFFFFF
  mediasize=18446744065119617025 -> mediasize/1048576=17592186036224 -> '17592186036224MB' = 16 chars + NUL = 17 bytes  -> char[16] OVERFLOW
path2 READ_CAPACITY_16 (atapi-fd.c:396): mediasize=be64toh(cap)*blocksize mod 2^64, cap=0xFFFFFFFFFFFFFFFF, blocksize=1
  mediasize=18446744073709551615 -> /1048576=17592186044415 -> '17592186044415MB' = 16 chars + NUL = 17 bytes  -> char[16] OVERFLOW
worst case over u64: (2^64-1)/2^20 = 17592186044415 = 14 digits -> 17 bytes total -> 1-byte NUL write past sizestring[16]
smallest triggering mediasize = 10^13 * 2^20 = 10485760000000000000 ; any device reporting >= that (e.g. capacity >= 2^44 sectors @512B) triggers
VERDICT: ksprintf writes 17 bytes into char sizestring[16] — CONFIRMED