# DF-2515 -- SCSI CDB copy overflows orb[7] into ind_ptr on 16-byte CDBs

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: dfv_sbp  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
kldload dfv_sbp.ko; sysctl kern.dfv_sbp_run=0; sysctl -n kern.dfv_sbp_status; sysctl kern.dfv_sbp_run=1; sysctl -n kern.dfv_sbp_status

## Expected
run.log: ind_ptr[0]=cfcecdcc/dddddddd with 16B CDB (canary cccccccc/dddddddd); control clean; fixed clean.

## Fix validation
fix.diff clamps the copy to 12 bytes with a log line; A/B canary intact.

Verdict: reproduced / impact=limited_write (see verdict.json, VERDICT.md)