# DF-1155 — heap overflow in `isp_handle_platform_atio` CDB copy

## Result
**NOT REPRODUCED** on this guest. Real source-level defense-in-depth bug;
fix authored.  See `VERDICT.md` for the full analysis.

## Build & run
```
./build.sh    # documents why no executable PoC is possible
./run.sh      # documents why runtime trigger is impossible
```

## Reachability summary (3 independent blockers)
1. The vulnerable function `isp_handle_platform_atio` is **not in the
   kernel binary** — all callers are inside `#ifdef ISP_TARGET_MODE`,
   which is not defined; `nm kernel.debug | grep -c isp_handle_platform_atio` ⇒ **0**.
2. `ISP_TARGET_MODE` is opt-in only (LINT64, commented out) — not in
   `X86_64_GENERIC`.
3. No QLogic parallel-SCSI HBA on the QEMU guest.

## Fix
`fix.diff` — clamp `at_cdblen` to `sizeof(cdb_bytes)` (= `IOCDBLEN` = 16)
at `sys/dev/disk/isp/isp_freebsd.c:1926-1927`.  Applies cleanly with
`git apply`.