login: df252x: rig loaded (set kern.df252x.addr from kldstat+nm, then kern.df252x.go=N)
df252x[32]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[32]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff801175fabc0 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=32, sense DMA slot=255 (last of 256)
df252x[32]: trm_Interrupt RETURNED (guest alive)
df252x[32]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff801175fabc0==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[32]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[32]: control: dest[32]=0x20 (0xDB sentinel untouched), sense_len still 0x20, scsi_status=0x02 (CHECK_COND intact) - NO overflow
df252x[32]: write extent: 0 bytes past sense_data start; in-struct live-field clobber bytes=0; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df252x[255]: layouts: sizeof(scsi_sense_data)=32 sizeof(ccb_scsiio)=320 sizeof(union ccb)=720 offsetof(csio,sense_data)=236 sense_data+max_copy=491
df252x[255]: dispatching production trm_Interrupt: DISCONNECT completion of SRB 0xfffff801175fabc0 TagNumber=255, SRBFlag=AUTO_REQSENSE, csio->sense_len=255, sense DMA slot=255 (last of 256)
df252x[255]: trm_Interrupt RETURNED (guest alive)
df252x[255]: SRBdone ran: pDCB->pActiveSRB=0 (cleared by trm.c:2402), pACB->pFreeSRB=0xfffff801175fabc0==SRB, GoingSRBCnt=0, pSRBSGL->address=0x11111111 (restored 0x11111111), SRBTotalXferLength=0x55555555 (restored 0x55555555), CmdBlock[0]=0x33 (restored 0x33), ccb_h.status=0x0000008c (CAM_SCSI_STATUS_ERROR|CAM_AUTOSNS_VALID)
df252x[255]: dest sense_data[0..31]: all 0x51 (DMA slot pattern): YES; first bytes: 51 51 51 51
df252x[255]: *** dest bytes [32..255) = 0xA7 (pattern that exists ONLY past the 256-slot sense_buffers array): CONFIRMED (223/223 bytes) -> OOB READ past the 32-byte DMA sense slot ***
df252x[255]: clobbered LIVE ccb fields: sense_len=0xa7 cdb_len=0xa7 sglist_cnt=0xa7a7 scsi_status=0xa7(set to 0x02 by trm.c:2528, overwritten!) sense_resid=0xa7 resid=0xa7a7a7a7 cdb_io.cdb_ptr=0xa7a7a7a7a7a7a7a7 msg_ptr=0xa7a7a7a7a7a7a7a7 msg_len=0xa7a7 tag_action=0xa7 tag_id=0xa7a7a7a7 init_id=0xa7a7a7a7
df252x[255]: write extent: 223 bytes past sense_data start; in-struct live-field clobber bytes=223; sentinel bytes past sizeof(union ccb) clobbered=0 (expected 0) -> OOB WRITE past the ccb heap allocation: no (write stayed in-struct)
df2523[ctl]: ring[0] TargetID=1 LUN=0 packed=0x0001 pActiveSRB=0