# DF-1270 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO request frame

## Source Location
sys/dev/raid/mps/mps_sas.c:1685-1689

## Verdict
Source-confirmed: Unchecked csio->cdb_len bcopy overflows 32-byte CDB32 in SCSI IO reque. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mpssas_action_scsiio at mps_sas.c:1685-1689: bcopy(csio->cdb_io.cdb_ptr/cdb_bytes,&req->CDB.CDB32[0],csio->cdb_len). cdb_len is u8 (0-255), CDB32 is 32 bytes at offset 0x40 of MPI2_SCSI_IO_REQUEST. cdb_len>32 -> 223B overflow into inline SGL and rest of per-command DMA request frame. CAM_CDB_POINTER path also derefs user ptr without copyin -> kernel panic on unmapped page. cdb_bytes path reads past 16-byte union. Impact bounded: SGL re-init overwrites corrupted area before firmware read. Sibling