# DF-2416 VERDICT

**Status:** reproduced
**Impact:** none
**Confidence:** certain

Production adw_intr CHECK_COND completion with user-supplied sense_len=255 executed the unclamped bcopy at adwcam.c:1321-1322: the 32-byte in-bounds 0xEE fill followed by the planted acb->links.sle_next pointer bytes (48 47 46 45 44 20 42 41 = 0x4142434445464748) and post-acb heap canary (0x6d) landed in ccb->csio.sense_data and past it; ccb->csio.cdb_len was corrupted to 0x47 (a byte of the leaked pointer overwrote it). Both the OOB read (acb tail: kernel pointer + heap) and the OOB write (223 bytes past csio.sense_data into neighboring CCB fields) demonstrated in one production dispatch; guest alive.

## Kernel references
- `sys/dev/disk/advansys/adwcam.c:384`
- `sys/dev/disk/advansys/adwcam.c:1321`
- `sys/dev/disk/advansys/adwcam.c:1322`

## Guest
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64

## Notes
same root cause class as DF-1510 (adwcam autosense); the mpt driver bounds this exact op with min()

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.