== BUILD (full untrimmed) ==
cc3582=0
cc3583=0
cc3584=0

== RUN df3582 ==
sizeof(sdparam) = 204
sizeof(fcparam) = 21576
SCSI dual-bus isp_param allocation = 408 bytes (isp_pci.c:827-832)
FCPARAM(isp,1)->sendmarker write offset = +0x5448 (21576) bytes
=> 21168 bytes PAST the end of the allocation

chan=0: write at +0 OK (in-allocation)
chan=1: FAULT (SIGSEGV/SEGV) touching 0x8004b5448 => offset 21576 from allocation start (21168 past end of 408-byte alloc)
rc=0

== RUN df3583 ==
sizeof(isp_rio1_t) = 64 (header 4 + req_handles[15])
rqs_seqno is 8 bits => card may claim up to 255 handles
max OOB stack read = (255-15)*4 = 960 bytes past qe[64]

FAULT (SIGSEGV/SEGV) at 0x800485000 => 0 bytes past the end of qe[64] (loop reached i == 16, array holds 15)
kernel impact: read of up to 960 bytes of kernel stack,
     values consumed as completion handles (isp_fastpost_complete)
rc=0

== RUN df3584 ==
sizeof(fcparam) = 21576; 2-channel allocation = 43152 bytes
offsetof(fcparam, isp_dev_map) = 20536 (entries: 512)

XPT_RESET_DEV on chan 1, target 0 => tgt = 0x10000
read address = base + 20536 + 2*65536 = base + 151608
=> 108456 bytes past the end of the 43152-byte allocation

FAULT (SIGSEGV/SEGV) at 0x8004d5038 => 108456 bytes past allocation end
kernel impact: wild kernel read during BDR handling (panic if unmapped / garbage index otherwise)
rc=0

== RUN df3583 (2nd) ==
sizeof(isp_rio1_t) = 64 (header 4 + req_handles[15])
rqs_seqno is 8 bits => card may claim up to 255 handles
max OOB stack read = (255-15)*4 = 960 bytes past qe[64]

FAULT (SIGSEGV/SEGV) at 0x800485000 => 0 bytes past the end of qe[64] (loop reached i == 16, array holds 15)
kernel impact: read of up to 960 bytes of kernel stack,
     values consumed as completion handles (isp_fastpost_complete)
rc=0

== RUN df3582 (2nd) ==
sizeof(sdparam) = 204
sizeof(fcparam) = 21576
SCSI dual-bus isp_param allocation = 408 bytes (isp_pci.c:827-832)
FCPARAM(isp,1)->sendmarker write offset = +0x5448 (21576) bytes
=> 21168 bytes PAST the end of the allocation

chan=0: write at +0 OK (in-allocation)
chan=1: FAULT (SIGSEGV/SEGV) touching 0x8004b5448 => offset 21576 from allocation start (21168 past end of 408-byte alloc)
rc=0

== ENV ==
DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
cc 8.3 [DragonFly] Release/2019-02-22
Copyright (C) 2018 Free Software Foundation, Inc.
-- no QLogic HBA:
0
-- isp in GENERIC kernel:
1
ls: /dev/isp*: No such file or directory