IBM Z protected service-call copy can read past a host heap buffer

d7913fac7747 (Christian Borntraeger, 2026-08-14). hw/s390x/sclp. Only copy the original SCCB buffer. Fixes 0f73c5b30b8b. Lore: qemu-devel 2026-08-14. The public commit says a later rewrite of the length was used as the copy size against a buffer allocated at the original length. Tools like ASAN can see the overrun. Secure guests lack the extended-length feature, and the ultravisor sanitizes the length, so the authors claim no QEMU heap contents reach the guest. The ordinary path already used the original length. Reviewed-by Matthew Rosato and Eric Farman. No public CVE id.

Landed with 562bae590f19 Merge tag s390x-20260826 (2026-08-26). Trust: guest vs host heap on default s390-ccw-virtio. This is not the earlier SCLP console-message crash.