# DF-3805 evidence pack

Unbounded `csio->cdb_len` bcopy into the 32-byte MPI2 CDB field
(`mprsas_action_scsiio`). `cdb_overlong.c` proves on the guest that the CAM
framework passes an oversized CDB straight to the SIM. Read `VERDICT.md`.
`verdict.json`: not_reproduced (no mpr SIM on guest; root-gated).