# DF-3930 — mly: `mly_cam_complete()` INQUIRY rewrite writes past a short CAM data buffer (heap OOB write)

## Build / Run (on hardware)
Needs an mly controller with a logical device and access to its pass(4)
device (root, or operator where devfs grants it):

  camcontrol cmd 3:0:0 -c "12 00 00 00 04 00" -d 4      # 4-byte INQUIRY data-in

or equivalently a pass(4) XPT_SCSI_IO CCB with `cdb_len=6`,
`cdb[0]=INQUIRY (0x12)`, `dxfer_len=4`, `CAM_DIR_IN` targeting the logical
volume.  `sc->mly_btl[bus][target].mb_flags & MLY_BTL_LOGICAL` must be set
(it is, for mly virtual targets).

## Expected result
`mly_cam_complete()` (status OK, cmd==INQUIRY) unconditionally rewrites
vendor/product/revision at `data_ptr+8..+36` (`padstr` calls,
mly.c:2343-2345) regardless of `dxfer_len`.  With a 4-byte buffer this writes
~32 bytes of device-descriptive text past a 4-byte kernel allocation —
adjacent heap corruption (mchunk metadata / neighbouring object headers).

No mly hardware in the audit guest → not runtime-reproduced; source-certain.
See VERDICT.md.