tag_types[tag_type] indexed without bounds check

Summary

devstat_end_transaction(:211-213) excludes DEVSTAT_TAG_NONE(==3) but no check >3 or <0. tag_types[3] array. Buggy driver passing 4/-1 -> adjacent field corruption (busy_time/start_time/flags). No current caller passes bad value.