Kernel stack/heap OOB write via untrusted total_disks in ata_raid_create and ata_raid_status ioctls

Summary

Two ioctl handlers iterate up to user/corpus-controlled disk count and index fixed 16-element arrays without bounds check. ata_raid_create IOCATARAIDCREATE loops disk<config->total_disks over config->disks[16] and rdp->disks[16]. ata_raid_status IOCATARAIDSTATUS loops i<rdp->total_disks over status->disks[16]. Both total_disks accepted verbatim. config->total_disks raw int from user; rdp->total_disks attacker-inflatable via metadata. IOCATARAIDCREATE with total_disks=200 overwrites ~184 bytes kernel stack past 84-byte struct. Reachable by operator-group /dev/ata. Stack-smashing privilege escalation.