oce_page_list() hardcodes the segment bound (8) regardless of the destination pages[] array size — latent out-of-bounds write into RQ/CQ mailbox commands

Summary

max_entries=8 always, but the RQ/CQ command structs embed pages[2]/pages[4] - safe today only because compile-time ring sizes land exactly at the array limits (RQ 8192B=2 pages, CQ 16384B=4). Any ring-size increase overwrites up to 48B of subsequent command fields (intra-object, stack). Hardware-gated (no Emulex on guest, verified). Thread-the-dimension fix.