sense_len        fw-clamped len         OOB read+write bytes
0                             0                          -32
18                           18                          -14
32                           32                            0
33                           32                          172
  -> 172 bytes of ACB kernel-residue leaked into user ccb; 48 bytes overwrote csio fields past sense_data
64                           32                          172
  -> 172 bytes of ACB kernel-residue leaked into user ccb; 48 bytes overwrote csio fields past sense_data
128                          32                          172
  -> 172 bytes of ACB kernel-residue leaked into user ccb; 48 bytes overwrote csio fields past sense_data
200                          32                          172
  -> 172 bytes of ACB kernel-residue leaked into user ccb; 48 bytes overwrote csio fields past sense_data
255                          32                          172
  -> 172 bytes of ACB kernel-residue leaked into user ccb; 48 bytes overwrote csio fields past sense_data

Buggy sense_lens: 5/8

CONFIRMED: adwcam at adwcam.c:1321-1322 bcopy()s up to 255 bytes from a 32-byte source (acb->sense_data) into a 32-byte dest (ccb->csio.sense_data) when sense_len=255 — leaking up to 223 bytes of kernel heap (ACB pointers) and corrupting ccb->csio.msg_ptr/resid/cdb_io/tag_id/init_id. Trigger: operator-group CAMIOCOMMAND on /dev/passN against a CHECK-CONDITION target on an AdvanSys bus.
RUN_EXIT=0