intel_guc_ads_create() indexes GUC_MAX_ENGINES_NUM-sized ADS arrays with sparse engine->guc_id (hw_id) values — out-of-bounds array writes on ICL (VCS3_HW=6) that stay contained inside the packed blob but corrupt GuC-visible ADS fields

Summary

guc_id comes from the sparse hw_id table (VCS3_HW=6, VECS2_HW=12) but the arrays are sized 5 - on ICL (has_guc=1 inherited) the BSD3 iteration writes white_list[6]/eng_state_size[6] past the arrays into reg_state_buffer/reserved padding (in-blob, first page). No kernel-memory corruption or leak (blob never read back); wrong GuC data only. Requires ICL + root params. Assert/skip guard fix.