debug.dfcam.vpd80_len: 20 -> 20
debug.dfcam.devtype: 0 -> 0
0 -> 0
0 -> 0
<DFCAM FAKEDEV 0.1>                at scbus2 target 0 lun 0 (pass1,da0,sg1)
/dev/pass0: vendor=QEMU     product=QEMU DVD-ROM     serial_num_len=0
/dev/pass1: vendor=DFCAM product=FAKEDEV serial_num_len=20
  DFCAM pass1 serial_num_len=20 (struct ccb_getdev.serial_num[252] + reserved + serial_num_len follow)
  serial_num[246..251] = 00 00 00 00 00 00
  cgd.reserved=00 cgd.serial_num_len=0x14 (final value after overflow bytes)
  serial bytes at 248..251 should be from the fake device ('a'..'z' pattern); bytes beyond 251 that came back = adjacent-heap OOB reads (0xC3 canary expected)
  raw ccb bytes at cgd end (+252..+260): 00 14 00 00 00 00 00 00
DFCAM: bus registered unit=0 path_id=2 devtype=0x0 vpd80_len=20 ses_nobj=24 (probe via debug.dfcam.rescan=0)
DFCAM: kernel-side XPT_SCAN_BUS on bus 2 (no SIM lock held)
DFCAM: scan of bus 2 complete status=0