trm_SRBdone auto-sense bcopy uses user-controlled sense_len to copy out of 32-byte DMA slot and into 32-byte csio field (heap OOB read+write via pass(4))

Summary

On auto-request-sense completion trm_SRBdone does bcopy(trm_get_sense_buf(pACB pSRB) &pcsio->sense_data pcsio->sense_len). sense_len u_int8_t propagated verbatim from userland. Source slot 32 bytes DMA hard-bounded destination csio->sense_data 32 bytes. sense_len>32 bcopy reads past source DMA slot kernel-heap info leak AND writes past sense_data into rest of csio corrupting cdb_io msg_ptr tag_action tag_id init_id.