# DF-1348 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** likely

## Finding
Unbounded bcopy of CDB into CmdBlock[12] overflows SRB on >12-byte CDBs

## Source Location
sys/dev/disk/amd/amd.c:399-400

## Verdict
Source-confirmed: Unbounded bcopy of CDB into CmdBlock[12] overflows SRB on >12-byte CDB. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
amd_action XPT_SCSI_IO at amd.c:399-400: bcopy(cdb_bytes,CmdBlock,cdb_len). CmdBlock[12] (amd.h:159). cdb_len u8 from CAM. cdb_len>12 overflows into pccb pointer. 16-byte CDB lands in padding on amd64. cdb_len>=17 corrupts pccb -> deref at :240. Sibling of DF-1235/DF-1270. Root/operator via pass(4). Fix: check cdb_len<=sizeof(CmdBlock).