0 -> 0
debug.dfcam.vpd80_len: 20 -> 255
0 -> 0
0 -> 0
/dev/pass0: vendor=QEMU     product=QEMU DVD-ROM     serial_num_len=0
/dev/pass1: vendor=DFCAM product=FAKEDEV serial_num_len=20
  DFCAM pass1 serial_num_len=20 (struct ccb_getdev.serial_num[252] + reserved + serial_num_len follow)
  serial_num[246..251] = 00 00 00 00 00 00
  cgd.reserved=00 cgd.serial_num_len=0x14 (final value after overflow bytes)
  serial bytes at 248..251 should be from the fake device ('a'..'z' pattern); bytes beyond 251 that came back = adjacent-heap OOB reads (0xC3 canary expected)
  raw ccb bytes at cgd end (+252..+260): 00 14 00 00 00 00 00 00
/dev/pass2: vendor=DFCAM product=FAKEDEV serial_num_len=0
  DFCAM pass2 serial_num_len=0 (struct ccb_getdev.serial_num[252] + reserved + serial_num_len follow)
  serial_num[246..251] = 6d 6e 6f 70 71 00
  cgd.reserved=00 cgd.serial_num_len=00 (final value after overflow bytes)
  serial bytes at 248..251 should be from the fake device ('a'..'z' pattern); bytes beyond 251 that came back = adjacent-heap OOB reads (0xC3 canary expected)
  raw ccb bytes at cgd end (+252..+260): 00 00 00 00 00 00 00 00
DFCAM: sprayed 192 kept canary objects of 255 bytes (0xC3 filled), 192 holes poked
DFCAM: bus registered unit=1 path_id=3 devtype=0x0 vpd80_len=255 ses_nobj=24 (probe via debug.dfcam.rescan=1)
DFCAM: kernel-side XPT_SCAN_BUS on bus 3 (no SIM lock held)
DFCAM: scan of bus 3 complete status=0