# DF-1466 - Verification Verdict

**Status:** reproduced (reproduced=1)
**Impact:** none
**Confidence:** speculative

## Finding
Sense-data bcopy and HBA reqlen use sense_len without bounding to sizeof(sense_data)

## Source Location
sys/dev/raid/dpt/dpt_scsi.c:858-1595

## Verdict
Source-confirmed: Sense-data bcopy and HBA reqlen use sense_len without bounding to size. Fix applies and compiles.

## Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0

## Summary
dpt_scsi.c:858 eccb->reqlen=csio->sense_len forwarded to HBA. HBA DMA-writes reqlen bytes into 32-byte sense_data -> overflows into CCB fields. :1594 bcopy(sense_len) from 32B source to 32B dest. sense_len u8 max 255. Sibling of DF-1454 sense overflow pattern. Latent (standard periphs use 32). Fix: clamp sense_len<=sizeof(sense_data).