Intel MatrixRAID heap OOB read via untrusted disk_idx and unvalidated map pointer

Summary

ata_raid_intel_read_meta computes map pointer by indexing meta->disk[] with untrusted u_int8_t total_disks then dereferences map->disk_idx[] with untrusted index masked to 16 bits to index meta->disk[] again. meta is fixed 1536-byte heap buffer. For total_disks>~21 map pointer past allocation. disk_idx masked 16 bits meta->disk[disk_idx] 48 bytes/element reads up to ~3MB past meta. bcopy copies 16 bytes arbitrary heap into raid->disks[].serial heap-garbage into .sectors. raid->total_disks=map->total_disks outer loop writes raid->disks[disk] for disk up to 255 OOB write.