sizeof(MPI2_REQUEST_HEADER) = 12
BUG: copyin 64 bytes into 12-byte tmphdr overflows by 52 bytes
frame bytes after copyin (offset: value, source):
  [ 0] 0x41  in-band (header)
  [ 1] 0x42  in-band (header)
  [ 2] 0x43  in-band (header)
  [ 3] 0x44  in-band (header)
  [ 4] 0x45  in-band (header)
  [ 5] 0x46  in-band (header)
  [ 6] 0x47  in-band (header)
  [ 7] 0x48  in-band (header)
  [ 8] 0x49  in-band (header)
  [ 9] 0x4a  in-band (header)
  [10] 0x4b  in-band (header)
  [11] 0x4c  in-band (header)
  [12] 0x4d  OUT-OF-BAND (stack smashed)
  [13] 0x4e  OUT-OF-BAND (stack smashed)
  [14] 0x4f  OUT-OF-BAND (stack smashed)
  [15] 0x50  OUT-OF-BAND (stack smashed)
  [16] 0x51  OUT-OF-BAND (stack smashed)
  [17] 0x52  OUT-OF-BAND (stack smashed)
  [18] 0x53  OUT-OF-BAND (stack smashed)
  [19] 0x54  OUT-OF-BAND (stack smashed)
  [20] 0x55  OUT-OF-BAND (stack smashed)
  [21] 0x56  OUT-OF-BAND (stack smashed)
  [22] 0x57  OUT-OF-BAND (stack smashed)
  [23] 0x58  OUT-OF-BAND (stack smashed)
  [24] 0x59  OUT-OF-BAND (stack smashed)
  [25] 0x5a  OUT-OF-BAND (stack smashed)
  [26] 0x41  OUT-OF-BAND (stack smashed)
  [27] 0x42  OUT-OF-BAND (stack smashed)
  [28] 0x43  OUT-OF-BAND (stack smashed)
  [29] 0x44  OUT-OF-BAND (stack smashed)
  [30] 0x45  OUT-OF-BAND (stack smashed)
  [31] 0x46  OUT-OF-BAND (stack smashed)
  [32] 0x47  OUT-OF-BAND (stack smashed)
  [33] 0x48  OUT-OF-BAND (stack smashed)
  [34] 0x49  OUT-OF-BAND (stack smashed)
  [35] 0x4a  OUT-OF-BAND (stack smashed)
  [36] 0x4b  OUT-OF-BAND (stack smashed)
  [37] 0x4c  OUT-OF-BAND (stack smashed)
  [38] 0x4d  OUT-OF-BAND (stack smashed)
  [39] 0x4e  OUT-OF-BAND (stack smashed)
  [40] 0x4f  OUT-OF-BAND (stack smashed)
  [41] 0x50  OUT-OF-BAND (stack smashed)
  [42] 0x51  OUT-OF-BAND (stack smashed)
  [43] 0x52  OUT-OF-BAND (stack smashed)
  [44] 0x53  OUT-OF-BAND (stack smashed)
  [45] 0x54  OUT-OF-BAND (stack smashed)
  [46] 0x55  OUT-OF-BAND (stack smashed)
  [47] 0x56  OUT-OF-BAND (stack smashed)
  [48] 0x57  OUT-OF-BAND (stack smashed)
  [49] 0x58  OUT-OF-BAND (stack smashed)
  [50] 0x59  OUT-OF-BAND (stack smashed)
  [51] 0x5a  OUT-OF-BAND (stack smashed)
  [52] 0x41  OUT-OF-BAND (stack smashed)
  [53] 0x42  OUT-OF-BAND (stack smashed)
  [54] 0x43  OUT-OF-BAND (stack smashed)
  [55] 0x44  OUT-OF-BAND (stack smashed)
  [56] 0x45  OUT-OF-BAND (stack smashed)
  [57] 0x46  OUT-OF-BAND (stack smashed)
  [58] 0x47  OUT-OF-BAND (stack smashed)
  [59] 0x48  OUT-OF-BAND (stack smashed)
  [60] 0x49  OUT-OF-BAND (stack smashed)
  [61] 0x4a  OUT-OF-BAND (stack smashed)
  [62] 0x4b  OUT-OF-BAND (stack smashed)
  [63] 0x4c  OUT-OF-BAND (stack smashed)

Primitive confirmed: 52 of 52 out-of-band bytes are attacker-controlled.
In the kernel these bytes overwrite saved RBP/RIP/locals on the function's stack frame.