cpu_id_to_apic_id[] lacks the -1 sentinel its sibling gets: lapic_config() initializes only apic_id_to_cpu_id[], so any unassigned forward mapping silently aliases APIC ID 0 (the BSP) — INIT/SIPI redirected at the running BSP

Summary

The reverse map gets -1 sentinels; the forward map stays BSS-zero so unassigned cpuids alias APIC ID 0 - start_ap does CPUID_TO_APICID(cpuid) with no sentinel check and sends INIT+SIPI to the BSP itself (reset/boot-loop), or a woken duplicate trips the cpuid-mismatch panic. Real holes reachable via the mptable HT-fixup path advancing arg->cpu for rejected synthetic entries (the DF-5343 territory); MADT assigns densely. Boot-time firmware-gated DoS. Sentinel-init + reject-at-IPI fix.