OOB read on piotiming[] via raw mode&ATA_MODE_MASK index writes garbage PIO timing to disk controller

Summary

Static const piotiming[] array has 5 elements (PIO0-PIO4) but ata_cyrix_setmode indexes it with piotiming[mode & ATA_MODE_MASK] (line 98). Because ATA PIO mode constants start at ATA_PIO0=0x08 (nata.h:203) the masked low nibble is 8-12 reading 3-7 elements (12-28 bytes) past end of 5-element array. Branch reached on every normal device probe: ata_pcichannel_setmode (ata-pci.c:863) calls ctlr->setmode(dev ATA_PIO_MAX) unconditionally inside ata_limit_mode settles on PIO mode always >= ATA_PIO0=0x08. OOB constant written to hardware PIO-timing register via ATA_OUTL programming disk controller with wrong (garbage) timing value causing silent disk data corruption. No info leak to userspace no privilege escalation OOB lands in same .rodata page as three small timing tables cannot fault. Every other nata chipset driver correctly uses ata_mode2idx(mode). Guard at line 84 is SAFE National clone (DF-2210) that dropped it is unsafe one. Data-integrity/reliability defect not memory-corruption exploit primitive.