# DF-1356 — AMR_CMD_PASS CDB heap overflow (amr)

## Summary
`amr_ioctl` (`sys/dev/raid/amr/amr.c:834`) copies a user-supplied CDB of
unchecked length (`au_cmd[2]`, 0..255) into the fixed 10-byte `ap_cdb` field of
a 128-byte DMA-coherent `union amr_ccb` via `bcopy`, overflowing into the
sense area, the DMA transfer-address pointer, and the adjacent ccb. Root-only
device (`/dev/amrN` mode 0600); no MegaRAID HBA on the audit guest.

## Reproduce
```
./build.sh   # cc -O2 -o harness harness.c
./run.sh     # ./harness
```
Expected: harness prints `245 bytes overflow past ap_cdb`, `ADJACENT ccb1
corrupted: YES`, `guard region past ccb1 corrupted: YES`. This is an
object-level proof — the amr driver cannot attach on the QEMU guest (no
MegaRAID HBA), so the in-kernel path is not runtime-reachable here.

## Fix
`fix.diff` clamps `len` to `AMR_MAX_CDB_LEN` after `len = au_cmd[2];`.
Validated to apply + compile (`amr.ko`, clean build rc=0).