# run:   2026-07-17T12:38:43Z
[DF-1356] union amr_ccb = 128 bytes; ap_cdb at offset 6, len=10
[DF-1356] ap_passthrough packed size = 62 bytes
[DF-1356] attacker len=255 (au_cmd[2]); AMR_MAX_CDB_LEN=10 -> 245 bytes overflow past ap_cdb
[DF-1356] ccb0.ap_request_sense_length now = 0x41 (attacker byte)
[DF-1356] ccb0.ap_data_transfer_address now = 0x41414141 (DMA ptr corrupted)
[DF-1356] ccb0.ap_data_transfer_length now = 0x41414141
[DF-1356] bytes written past ap_passthrough but inside ccb0: 66
[DF-1356] ADJACENT ccb1 corrupted: YES -> next DMA ccb overwritten (128 attacker bytes landed in it)
[DF-1356] guard region past ccb1 corrupted: YES (5 bytes)
[DF-1356] FIX: with 'if (len > AMR_MAX_CDB_LEN) len = AMR_MAX_CDB_LEN;' before the bcopy, write stays inside ap_cdb[10] -> no overflow
RUN_EXIT=0