feed_format_init does not bound the channel count: AFMT's 5-bit channel field (up to 31) flows unvalidated into ialign/oalign sizing against a reservoir and FXDIV table dimensioned for SND_CHN_MAX — latent reservoir heap overflow and snd_fxdiv_table OOB index if a >SND_CHN_MAX-channel format ever becomes constructible

Summary

Unlike its sibling feed_volume_init (:148) and its own set path (:195), init accepts any AFMT_CHANNEL - channels>SND_CHN_MAX would overflow the kmalloc'd reservoir and OOB-index the fxdiv table. NOT reachable today (all user paths clamp/matrix-gate to <=8ch) - defense-in-depth filed for the one-future-format-change hazard. Mirror-the-sibling-guard fix.