parse_dynamic() builds the symbol hash table at ef->address + d_ptr
without checking that d_ptr lies within the mapped image, so a crafted
DT_HASH entry causes an out-of-bounds read of the hash header. Reject
the object with ENOEXEC when the header does not fit in the image.