# Bounded MBR primary partition contract (K1521–K1525)

The parser reads exactly one 512-byte sector and requires signature `55 aa`.
Four 16-byte primary entries begin at byte 446. Empty entries are all zero.
Nonempty entries require boot flag 0 or `80`, nonzero type, start LBA at least
one, and nonzero sector count. Extended and protective GPT types are refused;
they cannot be silently treated as mountable primary partitions.

Each partition has an exclusive end computed with checked addition. The end
must be at or below the device sector count. Every pair of nonempty entries
must be disjoint; adjacent ends are valid. The parser returns a complete table
or one explicit error and owns no DMA frame. `MountState::mount` publishes a
whole table only after parsing and checked generation increment succeed. A
malformed table cannot partially mount or replace a healthy mount.

Local tests cover two valid primaries, adjacent and final sector boundaries,
overlap, out-of-capacity range, bad signature and unsupported layouts. K1525
must read a real disk in a guest, reject overlapping partitions before mount
publication, retain existing healthy service, and return all frames after
device reset in direct and UEFI profiles.