red zone violation in ntfs_runlists_merge()

The following mounts a corrupt NTFS image that produces a red zone
violation:

# uname -a
Linux xxx 7.2.0-rc7-00016-g3d6d817622b0 #40 SMP PREEMPT_DYNAMIC Wed Aug 12 13:01:40 EDT 2026 x86_64 x86_64 x86_64 GNU/Linux
# wget http://www.rtmrtm.org/rtm/ntfs2b.img.gz
# gunzip ntfs2b.img.gz
mount -t ntfs -o loop ntfs2b.img /mnt
[Right Redzone overwritten] 0xffff888100321300-0xffff888100321307 @offset=4864. 
...

The overrun occurs in the last three lines of this code in
ntfs_runlists_merge():

                        drl[ds].length = marker_vcn - drl[ds].vcn;
                        /* Finally add the ENOENT terminator. */
                        ds++;
                        if (!slots) {
                                drl = ntfs_rl_realloc_nofail(drl, ds, ds + 1);
                                rtm_check(drl);
                                *new_rl_count += 1;
                        }
                        drl[ds].vcn = marker_vcn;
                        drl[ds].lcn = LCN_ENOENT;
                        drl[ds].length = (s64)0;

After the ds++, ds is too large, but slots == 1.

Robert Morris
[email protected]