Residual recorded when #41 (NSCMD_DEVICEQUERY on a plain IOStdReq) landed as b309892.
NETDEV_IO_IS_SHORT() (src/netdev/netdev_internal.h) treats mn_Length == 0 as a FULL IOSana2Req, by design and consistently for Open, Close, BeginIO and the query, because SANA-II callers that leave mn_Length unset depend on it. The consequence for netdev_nsd_query() (src/netdev/netdev_cmds.c): a hand-built 48-byte IOStdReq with mn_Length 0 sending NSCMD_DEVICEQUERY is answered in the SANA-II form, reading ios2_Data/ios2_DataLength at +76/+72, past the end of the 48-byte request, and may write the 16-byte answer through whatever is there.
CreateIORequest() sets mn_Length, so callers that allocate normally are safe. No known program sends the zero-length form; tracking it in case one appears. A possible narrowing: in the query only, treat mn_Length == 0 as the IOStdReq form (the NewStyle spec's form) since the SANA-II form is only what mcastfilter sends, and mcastfilter sets mn_Length.
🤖 Generated with Claude Code
Residual recorded when #41 (
NSCMD_DEVICEQUERYon a plain IOStdReq) landed as b309892.NETDEV_IO_IS_SHORT()(src/netdev/netdev_internal.h) treatsmn_Length == 0as a FULL IOSana2Req, by design and consistently for Open, Close, BeginIO and the query, because SANA-II callers that leavemn_Lengthunset depend on it. The consequence fornetdev_nsd_query()(src/netdev/netdev_cmds.c): a hand-built 48-byte IOStdReq withmn_Length0 sendingNSCMD_DEVICEQUERYis answered in the SANA-II form, readingios2_Data/ios2_DataLengthat +76/+72, past the end of the 48-byte request, and may write the 16-byte answer through whatever is there.CreateIORequest()setsmn_Length, so callers that allocate normally are safe. No known program sends the zero-length form; tracking it in case one appears. A possible narrowing: in the query only, treatmn_Length == 0as the IOStdReq form (the NewStyle spec's form) since the SANA-II form is only what mcastfilter sends, and mcastfilter setsmn_Length.🤖 Generated with Claude Code