# DF-1317 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Heap buffer overflow in sbp_fix_inq_data via short INQUIRY data buffer

## Source Location
sys/dev/disk/sbp/sbp.c:1504-1529

## Verdict
Source-confirmed: Heap buffer overflow in sbp_fix_inq_data via short INQUIRY data buffer. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
sbp_fix_inq_data at sbp.c:1504: inq=(struct scsi_inquiry_data*)ccb->csio.data_ptr without checking dxfer_len>=36. Writes inq->vendor(8B at offset 8), product(16B at offset 16), revision(4B at offset 32). Short buffer (e.g. 5B via pass(4)) -> heap overflow up to 31B. Overflow content from sdev->vendor/product/revision (partially device-controlled via CSR ROM). Root only (pass/sg). Sibling of DF-1285 (hptmv INQUIRY). Fix: check dxfer_len>=offsetof(revision)+4.