== BEFORE-FIX (vulnerable) ==
BUG: copyout(ap_request_sense_area[32], user, 255) leaks 223 bytes of adjacent ccbs/DMA array
== AFTER-FIX ==
FIX: length clamped to AMR_MAX_REQ_SENSE_LEN=32, no over-read