=== FIX VALIDATION RUN 1 (fix.diff applied to emulation kernel; same crafted attack:
===     df_audit.mode=1 df_audit.capfail=1 df_audit.pl=255 (page_length=0xff)) ===
opened /dev/acd0 fd=3 uid=0 euid=0
CDIOREADTOCHEADER: Input/output error
READTOCENTRYS data_len=0xffff -> ret=-1 errno=5 (Input/output error)  [expect EINVAL]
CDRIOCGETBLOCKSIZE -> ret=0 bs=2048
CDRIOCFIXATE -> ret=-1 errno=22 (Invalid argument)      <-- clamp rejected crafted page_length
survived (no panic)

kernel console:
DFAUDIT: CDRIOCFIXATE entered, multisession=2048
DFAUDIT: acd_fixate entered, calling mode_sense(0x05)
DFAUDIT: hook ccb0=5a ccb2=05 cnt=64 mode=1 capfail=1 err=5
DFAUDIT: forged MODE_SENSE(0x05) page_length=0xff       <-- device still attacks
(no MODE_SELECT line: no data-out issued, zero stack bytes disclosed)
(no panic)