REX.R prefix causes OOB read across all Group/FPU escape tables (f_reg returns 8..15 into 8-entry arrays)

Summary

f_reg at db_disasm.c:908 returns 8..15 when REX.R set. All Group/FPU tables (db_Grp1..9, db_Esc8..f) have 8 entries. Prefix loop :1231-1234 accepts any REX byte. db_disasm_esc :1080 and Group handlers :1271/:1279/:1284/:1290 index with f_reg unmasked -> REX.R + Group/FPU opcode -> OOB read. Compilers never emit REX.R before Group/FPU (semantically ignored) so not reachable from in-tree kernel code. Requires DDB operator disassembling crafted bytes. Defense-in-depth: mask f_reg&0x7 at Group/Esc sites (keep wide for genuine register operands).