# DF-5333 evidence pack — `chdone()` CH_CCB_PROBE reads and prints uninitialized stack `announce_buf[80]` when `cherror()` returns 0 for a non-CAM_REQ_CMP completion

## Finding (one line)
`chdone()` (sys/bus/cam/scsi/scsi_ch.c:541) declares
`char announce_buf[80];` and only initializes it in the
`CAM_REQ_CMP` branch (ksnprintf, :562) and in the `error != 0` branch
(`announce_buf[0] = '\0'`, :636). A device that completes the probe
MODE SENSE with **SCSI status INTERMED** (or CHECK CONDITION with a
RECOVERED-ERROR sense, `SS_NOP`) makes `cam_periph_error()` return
**0** while the CAM status is **not** CAM_REQ_CMP
(cam_periph.c:1313-1318 `SCSI_STATUS_INTERMED => error = 0`;
cam_periph.c:1510-1513 `SS_NOP => error = 0`), so **neither branch
runs**: `announce_buf[0]` is read uninitialized at scsi_ch.c:639 and,
when non-zero, the whole buffer is printed to the console with `%s` by
`xpt_announce_periph()` (cam_xpt.c:1761-1763) — a kernel-stack info
leak into the console/dmesg ring (up to 80 bytes, or further until a
NUL).

## Reproduce (guest, root; EVIL kernel = GENERIC + `device ch`)
```
cd /root/df5333
./build.sh && ./run.sh
```
- `evilcd3.ko` (same rig as DF-5332) fakes the T_CHANGER.
- `debug.evilcd.probeannounce=1` paints the sysctl thread's stack with
  0x42 (~4KB, via `ev_paint_deep`), arms the one-shot INTERMED MODE
  SENSE, and rescans the bus **inline on the same thread**, so the
  attach-time probe (chstart CH_STATE_PROBE -> chdone CH_CCB_PROBE)
  runs on the groomed stack.
- The rig's XPT_GET_TRAN_SETTINGS handler returns success (required —
  `xpt_announce_periph()` bails before printing the string otherwise).

## Expected (vulnerable kernel)
Console/dmesg shows:
```
[EVILCH] MODE SENSE page 0x1d -> INTERMED (error==0 path)
ch0 at evilch0 bus 0 target 1 lun 0
ch0: <EVILCH OOBTEST 1.0> ...
ch0: BBBBBBBBBBBBBBBBBB...   <-- uninitialized stack, printed with %s
```
(the exact garbage depends on the stale stack contents; with the paint
knob it is deterministic `0x42` if the probe executes on the groomed
thread). With the patched kernel (fix.diff: `announce_buf[0] = '\0';`
up front) no garbage line can appear — the driver announces nothing or
the normal counts string only.