=== DF-1185 logic-level result ===
sizeof(struct CMD_MESSAGE_FIELD) = 1060 bytes
Attacker dxfer_len (CAM allocation) = 32 bytes
Existing guard rejects too-large only?  NO (the bug: small is allowed)
messagedatabuffer offset within CMD_MESSAGE_FIELD = 28 bytes
READ_RQBUFFER loop writes up to 1031 bytes into messagedatabuffer
Of those, 4 byte(s) land INSIDE the 32-byte CAM allocation,
            1027 byte(s) land PAST the allocation (CWE-787).

On this guest the kernel path is HW-gated: arcmsr_action()
(arcmsr.c:2993) dispatches target_id==16 CCBs to
arcmsr_handle_virtual_command() -> arcmsr_iop_message_xfer()
(arcmsr.c:2604) ONLY on the SCSI bus arcmsr registers via
arcmsr_attach(), which runs only when arcmsr_probe() finds an
Areca PCI card (vendor 0x17D3). The QEMU guest has no Areca
hardware, so the path is unreachable. /dev/pass0 is also mode
0600 root:operator, so unprivileged maxx cannot open it.
RUN_EXIT=0