[struct]

Fixes from Claude, October 2026

fix out of range free from zone and inverted ALLOC_SANITY sampling gate

iso_free_chunk_from_zone compared the bitmap qword index with > instead
of >= against max_bitmap_idx, which is a count. A free of the chunk one
past the end of a zone's user pages passed the check and read/wrote the
qword one past the zone's bitmap. Small bitmaps are slices of a shared
page so that qword belongs to a neighboring zone, and clearing an
in-use bit there lets that zone hand out a live chunk a second time.

_iso_free_from_zone skipped iso_find_zone_range entirely when a zone
was passed in and never validated that p was inside that zone. It now
aborts if p is outside [user_pages_start, user_pages_start +
ZONE_USER_SIZE). Under ARM_MTE the comparison uses the untagged pointer
so valid tagged frees are not rejected.

The ALLOC_SANITY sampling gate in _iso_alloc tested zone != NULL, the
opposite of its comment. Normal allocations were never sampled and
private zone allocations were, and _iso_free_from_zone had no
_iso_alloc_free_sane_sample check so freeing a sampled chunk through
the zone API reached iso_free_chunk_from_zone with a garbage offset and
aborted. The gate is now zone == NULL and _iso_free_from_zone checks
for a sampled chunk before validating p against the zone, since
sampled chunks live in their own guarded pages outside any zone.

Also a clang-format whitespace fix in iso_strndup_from_zone