# DF-2530 verdict -- Unclamped sense_len overflows the 32-byte sense_data on CHECK CONDITION

status: reproduced   reproduced: 1   impact: limited_write
confidence: certain   attempts: 2   runtime_sec: 700

vpo_intr hands csio->sense_len (user CCB byte, 0..255 via pass(4) xpt_merge_ccb) and &csio->sense_data (32 bytes) to the transfer engine; the verbatim imm_do_scsi wrote 255 bytes (count=255) into the 32-byte field - the rig dump shows sense bytes 28..39 all 0x5A and the post-CCB markers destroyed: cdb_len=0x5a sglist_cnt=0x5a5a scsi_status=0x5a sense_resid=0x5a resid=0x5a5a5a5a (pre-set markers 11/22/33/44/55) - 223 bytes past the field into the rest of union ccb, exactly the field list in the finding. Control (sense_len=32) leaves the markers intact. This is the same unclamped-length class as DF-2522 (trm), which this project already reproduced with the production handler. Fixed-caller model (vpo.c clamps to sizeof sense_data before the call) A/B: 32 bytes written, markers intact.

## Evidence (decisive lines)
DF2530[sense_len=255]: sizeof(sense_data)=32; verbatim transfer wrote count=255 bytes
DF2530: sense bytes 28..39: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a
DF2530: post-CCB: cdb_len=0x5a sglist_cnt=0x5a5a scsi_status=0x5a sense_resid=0x5a resid=0x5a5a5a5a (markers 11/22/33/44/55)
DF2530: RESULT=OVERFLOW (sense_len>32 written into the rest of the CCB)
--- control (sense_len=32) --- markers intact, clean
--- fixed-caller model (clamp 32) --- markers intact, clean




## Exploit chain / privesc assessment
local privileged (root/operator via pass(4) on the vpo bus, plus physical parallel-port device); bounded CCB corruption, not arbitrary write.

## Fix + A/B
fix.diff clamps the REQUEST_SENSE length to sizeof(csio->sense_data) in vpo_intr before the call; A/B clean.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.