P packet out-of-bounds stack write via NUM_REGS/struct mismatch and missing lower bound

Summary

P (set one register) packet validates register index only with regno<NUM_REGS where NUM_REGS hardcoded 22 but struct x86_64regs only 152 bytes = 19 eight-byte slots. Indices 19 20 21 write 8 bytes each past end of registers stack local. hexToInt() produces signed int with no sign rejection so parsed value 0xffffffff yields regno=-1 which passes regno<22 and writes 8 bytes at &registers-8. P handler hex2mem(ptr (vm_offset_t)&registers+regno*8 8). Result kernel-stack OOB write of attacker-controlled bytes at attacker-controlled offsets. Corrupts adjacent locals saved rbp return address. Attacker: GDB debug console holder (serial sio 0x80 flag dcons/FireWire) while kernel in GDB stub.