sizeof(struct scsi_inquiry_data) = 256
offsetof(vendor_specific1)       = 96
vendor_specific1[0] byte offset  = 96
vendor_specific1[1] byte offset  = 97
SHORT_INQUIRY_LENGTH             = 36
sizeof(struct scsi_inquiry_data) = 256
offsetof(vendor_specific1)       = 96
vendor_specific1[0] byte offset  = 96
vendor_specific1[1] byte offset  = 97
SHORT_INQUIRY_LENGTH             = 36

CAM DV1 inquiry_len = 38 (additional_length=32)

[UNPATCHED] mode=0, buffer=38 bytes, write at offset 96/97

--- result (mode=0 UNPATCHED) ---
buffer length (inquiry_len) = 38 bytes ([0..37])
write target offsets = 96 / 97 (OUT-OF-RANGE / OUT-OF-RANGE past end)
canary clobbered at 96/97: YES / YES (0x01/0x02 vs canary 0xcd)

*** HEAP OVERFLOW CONFIRMED (mode 0) ***
wrote 0x01 at arena[96] and 0x02 at arena[97]
(canary was 0xcd; these bytes are 58/59 past the 38-byte allocation)
In-kernel: kmalloc(38) -> slab chunk; offset 96/97 lands in the ADJACENT slab object.
sizeof(struct scsi_inquiry_data) = 256
offsetof(vendor_specific1)       = 96
vendor_specific1[0] byte offset  = 96
vendor_specific1[1] byte offset  = 97
SHORT_INQUIRY_LENGTH             = 36

CAM DV1 inquiry_len = 38 (additional_length=32)

[PATCHED] mode=1, buffer=38 bytes, write at offset 96/97

--- result (mode=1 PATCHED) ---
buffer length (inquiry_len) = 38 bytes ([0..37])
write target offsets = 96 / 97 (OUT-OF-RANGE / OUT-OF-RANGE past end)
canary clobbered at 96/97: no / no (0xcd/0xcd vs canary 0xcd)

*** NO OVERFLOW (mode 1): write correctly skipped/guarded ***
arena[96]=0xcd arena[97]=0xcd (canary intact=0xcd)

=== SUMMARY ===
UNPATCHED logic: OVERFLOW (bug present)
PATCHED   logic: clean (fix holds)
VERDICT: bug reproduced on unpatched logic, fixed on patched logic.
RUN_RC=0