sizeof(isp24xx_statusreq_t) = 64 (QENTRY_LEN=64)
req_rsp_sense at offset 36, length 28
rlen=0      -> snsp offset=36     memcpy=32 bytes  read range=[36,68) >>> OOB READ PAST qe[64]
rlen=4      -> snsp offset=40     memcpy=32 bytes  read range=[40,72) >>> OOB READ PAST qe[64]
rlen=27     -> snsp offset=63     memcpy=32 bytes  read range=[63,95) >>> OOB READ PAST qe[64]
rlen=28     -> snsp offset=64     memcpy=32 bytes  read range=[64,96) >>> OOB READ PAST qe[64]
   leak demo: sense bytes copied from past qe[64] = a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1  (all 0xA1 == adjacent-stack marker)
rlen=32     -> snsp offset=68     memcpy=32 bytes  read range=[68,100) >>> OOB READ PAST qe[64]
rlen=64     -> snsp offset=100    memcpy=32 bytes  read range=[100,132) >>> OOB READ PAST qe[64]
rlen=4096   -> snsp offset=4132   memcpy=32 bytes  read range=[4132,4164) >>> OOB READ PAST qe[64]

result: 7/7 firmware-controlled rlen values read past the 64-byte stack entry
DF-1125: CONFIRMED OOB read primitive (kernel stack info leak / panic)

--- WITH FIX (clamp rlen to sizeof(req_rsp_sense), slen to 28-rlen) ---
rlen=0      -> clamped rlen=0   slen=28  read range=[36,64) (in bounds)
rlen=4      -> clamped rlen=4   slen=24  read range=[40,64) (in bounds)
rlen=27     -> clamped rlen=27  slen=1   read range=[63,64) (in bounds)
rlen=28     -> clamped rlen=28  slen=0   read range=[64,64) (in bounds)
rlen=32     -> clamped rlen=28  slen=0   read range=[64,64) (in bounds)
rlen=64     -> clamped rlen=28  slen=0   read range=[64,64) (in bounds)
rlen=4096   -> clamped rlen=28  slen=0   read range=[64,64) (in bounds)
FIX result: 0 OOB cases remain (expect 0)
DF-1125 FIX: VALIDATED - clamps eliminate all OOB reads
RUN=0