adaptExt->blk_discard is limited to 16 descriptors, but RhelDoUnMap() never validates the number of descriptors it writes to the array. This is wrong for two separate reasons:

MAX_DISCARD_SEGMENTS is 256, so we may in theory even advertise support for a lot more segments than can actually fit in the array and even well behaving applications could trigger an overrun. (This is mostly theoretical because QEMU's virtio-blk implementation advertises 1 currently.)

The other reason is that BlockDescrCount is taken from a user buffer and has never been validated, so it can exceed the advertised maximum. I reproduced the problem by issuing an unmap request with 1024 descriptors and got an immediate BSOD. RhelDoUnMap() must explicitly validate the number of descriptors.

Use MAX_DISCARD_SEGMENTS as the size of adaptExt->blk_discard to make sure the advertised maximum is actually supported; advertise the full range instead of limiting to MAX_DISCARD_SEGMENTS - 1. Reduce MAX_DISCARD_SEGMENTS to 16 to avoid increasing the array size. And finally check first that the user buffer is even large enough that we can safely access blockDescrDataLength in it.