DF-2531 / run.log
DF2531[mode=0 cdb_len=255]: cdb_bytes at ccb+280; OUT bytes clocked=256 (in-bounds=16 OOB=240) DF2531: first OOB bytes (cdb_bytes[16..]): 34 12 fe ca ef be ad de 6d 6d 74 a5 DF2531: msg_ptr in CCB = 0xdeadbeefcafe1234 (bytes 34 12 fe ca ef be ad de in stream = kernel pointer disclosed to peripheral) DF2531: vpo_stat=0 vpo_count=0 RESULT=OOB READ: cdb_len>16 clocked kernel heap past cdb_bytes[16] (incl. msg_ptr) out the parallel port DF2531[mode=1 cdb_len=16]: cdb_bytes at ccb+280; OUT bytes clocked=16 (in-bounds=16 OOB=0) DF2531: first OOB bytes (cdb_bytes[16..]): DF2531: msg_ptr in CCB = 0xdeadbeefcafe1234 (bytes 34 12 fe ca ef be ad de in stream = kernel pointer disclosed to peripheral) DF2531: vpo_stat=0 vpo_count=0 RESULT=no OOB (legal cdb_len) DF2531[mode=2 cdb_len=255]: cdb_bytes at ccb+280; OUT bytes clocked=16 (in-bounds=16 OOB=0) DF2531: first OOB bytes (cdb_bytes[16..]): DF2531: msg_ptr in CCB = 0xdeadbeefcafe1234 (bytes 34 12 fe ca ef be ad de in stream = kernel pointer disclosed to peripheral) DF2531: vpo_stat=0 vpo_count=0 RESULT=no OOB (clamped call)