case                                        EDL     buggy_sz   correct_sz
normal EventDataLength=8                      8           32           32
EventDataLength=24 (reply sz)                24           96           96
EventDataLength=0x4000 -> sz=0            16384            0        65536
EventDataLength=0x4001 -> sz=4            16385            4        65540
EventDataLength=0x4002 -> sz=8            16386            8        65544
EventDataLength=0xFFFF -> sz=0xFFFC       65535        65532       262140

Buggy: 4/6 cases produce a truncated (wrong) size.
CONFIRMED: u16 sz truncation at mpr_sas_lsi.c:148 yields kmalloc(0) -> ZERO_LENGTH_PTR deref panic (EDL=0x4000) and kmalloc(4)-then-OOB-parse (EDL=0x4001). A malicious or compromised SAS3 HBA programming the reply DMA can choose EDL to control the truncated size precisely.
RUN_EXIT=0