> Looks like amiflop.c:find_floppy() needs a check, too? >
AFAICS there is no array index bug in floppy_find() in amiflop.c. The 'unit' array's size is FD_MAX_UNITS which is defined as 4 in include/linux/amifd.h, and the array index is drive = *part & 3.