uguru_attach sensor-table loop writes sc_sensors[i] with no bound against UGURU_MAX_SENSORS — one table entry away from a kernel softc overflow

Summary

The attach loop's only terminator is the NULL desc - never checked against UGURU_MAX_SENSORS=27. Script-verified current tables max at 26 entries: exactly one slot of headroom before attach writes past sc_sensors into adjacent softc fields. Table chosen by hardware sysid, not attacker-controlled; latent defense-in-depth for the table-driver overflow class. Bound-guard fix.