# DF-1291 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Sense copyout over-reads 64-byte command packet in mly_user_command

## Source Location
sys/dev/raid/mly/mly.c:2922-2925

## Verdict
Source-confirmed: Sense copyout over-reads 64-byte command packet in mly_user_command. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
mly_user_command at mly.c:2922-2925: copyout(mc->mc_packet,uc->RequestSenseBuffer,min(RequestSenseLength,mc->mc_sense)). mc_packet is sizeof(union mly_command_packet)=64 bytes (mlyreg.h:1167). mc_sense up to 255. No clamp to sizeof(packet). Malicious HBA returns sense_length>64 -> copyout reads up to 191 bytes past packet into adjacent DMA/heap -> kernel address leak. Root only. Fix: szmin(min(RequestSenseLength,mc_sense),sizeof(packet)).