--- run 1: edtlen=512 ddtl=1MiB (the finding's PoC) ---
=== iscsi_r2t() WITHOUT fix ===
edtlen=512  ddtl=1048576  maxXmitDS=65536
[OOB READ CONFIRMED] attacker received 1048064 bytes PAST the 512-byte CCB buffer
first leaked byte past buffer = 0xDE (was 0xDE in our model of adjacent kernel heap)
VERDICT: iscsi_r2t() walks csio->data_ptr past its allocation -> kernel heap info leak.

=== iscsi_r2t() WITH proposed fix ===
[REJECTED by bounds check] bo=0 ddtl=1048576 edtl=512
VERDICT: bounds check rejects the over-long R2T; 0 bytes leaked past buffer.
rc=1

--- run 2: edtlen=512 ddtl=0x4000000 (64 MiB) ---
=== iscsi_r2t() WITHOUT fix ===
edtlen=512  ddtl=67108864  maxXmitDS=65536
[OOB READ CONFIRMED] attacker received 67108352 bytes PAST the 512-byte CCB buffer
first leaked byte past buffer = 0xDE (was 0xDE in our model of adjacent kernel heap)
VERDICT: iscsi_r2t() walks csio->data_ptr past its allocation -> kernel heap info leak.

=== iscsi_r2t() WITH proposed fix ===
[REJECTED by bounds check] bo=0 ddtl=67108864 edtl=512
VERDICT: bounds check rejects the over-long R2T; 0 bytes leaked past buffer.
rc=1

--- run 3: edtlen=4096 ddtl=0x100000 (1 MiB) ---
=== iscsi_r2t() WITHOUT fix ===
edtlen=4096  ddtl=1048576  maxXmitDS=65536
[OOB READ CONFIRMED] attacker received 1044480 bytes PAST the 4096-byte CCB buffer
first leaked byte past buffer = 0xDE (was 0xDE in our model of adjacent kernel heap)
VERDICT: iscsi_r2t() walks csio->data_ptr past its allocation -> kernel heap info leak.

=== iscsi_r2t() WITH proposed fix ===
[REJECTED by bounds check] bo=0 ddtl=1048576 edtl=4096
VERDICT: bounds check rejects the over-long R2T; 0 bytes leaked past buffer.
rc=1