# DF-2536 — Sense-data bcopy length not capped to 32-byte sense buffer

## Verdict: NOT REPRODUCED (HW-gated) — source bug CONFIRMED

## Hardware gate

No LSI Logic MPT HBA in guest: `kldstat` shows only kernel/ehci/xhci; `pciconf -l`
shows no LSI device. No SCSI I/O completions with autosense occur.

## Source trace (confirmed real bug)

**File:** `sys/dev/disk/mpt/mpt_cam.c:3141-3150`

```c
sense_returned = le32toh(scsi_io_reply->SenseCount);  // line 3141: IOC-supplied U32
...
bcopy(req->sense_vbuf, &ccb->csio.sense_data,
    min(ccb->csio.sense_len, sense_returned));        // line 3149-3150
```

`MPT_SENSE_SIZE` is 32 (`mpt.h:823`). The driver tells the IOC max 32 bytes of
sense wanted, but `SenseCount` in the reply is a 32-bit IOC-supplied value that is
**never validated against 32**. If the IOC reports `SenseCount > 32`, the `bcopy`
reads up to 255 bytes from the 32-byte `req->sense_vbuf` (leaking adjacent
request-frame kernel memory: CDB, SGL entries, MsgContext) and writes up to 255
bytes into the 32-byte `ccb->csio.sense_data` (heap overflow into the rest of the
CCB). Other code paths correctly cap to `MPT_SENSE_SIZE` (lines 2119-2120, 4527-4528).

## Fix

Added `if (sense_returned > MPT_SENSE_SIZE) sense_returned = MPT_SENSE_SIZE;` before
the `bcopy`. See `fix.diff`.

## Impact (on HW that has the HBA)

Medium — heap overflow into CCB + info leak of request-frame kernel memory via
malicious/faulty IOC returning descriptor-format sense (up to 252 bytes).