P packet out-of-bounds stack write via NUM_REGS/struct mismatch and missing lower bound

Summary

P (set one register) packet validates register index only with regno<NUM_REGS where NUM_REGS hardcoded 22 but struct x86_64regs only 152 bytes = 19 eight-byte slots. Indices 19 20 21 write 8 bytes each past end of registers stack local. hexToInt() produces signed int with no sign rejection so parsed value 0xffffffff yields regno=-1 which passes regno<22 and writes 8 bytes at &registers-8. P handler hex2mem(ptr (vm_offset_t)&registers+regno*8 8). Result kernel-stack OOB write of attacker-controlled bytes at attacker-controlled offsets. Corrupts adjacent locals saved rbp return address. Attacker: GDB debug console holder (serial sio 0x80 flag dcons/FireWire) while kernel in GDB stub. [VERIFIED pass2: reproduced against the REAL stock stub in the shipped kernel over a serial debug console - g reply proves sizeof registers 152 vs NUM_REGS 22, P13-P15 land exact attacker bytes at +152 +160 +168, Pffffffff passes as regno -1 writing at registers-8, Pffffffe0 reaches registers-0x100, saved-register slot write at +152 kills the VM on resume twice; RIP control itself out of reach on this gcc -O2 layout (retaddr at +208) and kernel image 127TiB above kstack; console-holder reach only, no unpriv network path; bounds fix-validated]