BSS out-of-bounds write on global ata_raid_arrays[] via untrusted LSI v2 raid_number

Summary

ata_raid_lsiv2_read_meta indexes global pointer array raidp[] (ata_raid_arrays[MAX_ARRAYS=16]) at array+meta->raid_number where array ranges 0..15 and meta->raid_number is raw u_int8_t from disk. Sum can reach 270 so parser writes freshly kmallocd ar_softc pointer into arbitrary BSS up to ~2KB past end of global array corrupting adjacent kernel globals. No check array+meta->raid_number<MAX_ARRAYS. array+=meta->raid_number further corrupts loop counter. Attacker: crafted LSI v2 superblock magic XIDE at LSIV2_LBA.