# DF-1189 — ciss_notify_logical: unbounded bus/target from controller notify event

## Finding
`ciss_notify_logical()` (`ciss.c:3923-3972`) takes
`bus = cn->device.physical.bus` and `target = cn->data.logical_status.logical_drive`
directly from a controller DMA'd notify event and uses them as indices into
`sc->ciss_logical[bus][target]` (`:3933`) **with no bounds check**. The
allocation is `[ciss_max_logical_bus][CISS_MAX_LOGICAL=15]`
(`cissvar.h:49,230`; populated at `ciss.c:1373-1378`). `logical_drive` is a
`u16` (0-65535, `cissreg.h:331`) and `bus` is a multi-bit field, so both can
be far out of range. The function then writes `ld->cl_status`, `ld->cl_update`
(`:3951,3959,3971-3972`) and dereferences `ld->cl_lstatus->status`
(`:3952-3953`) — a kernel OOB write + an OOB-pointer dereference.

## Why harness
`ciss` IS in `X86_64_GENERIC` but only attaches to HP/Compaq Smart Array
controllers (PCI vendor `0x0e11`); none on the QEMU guest. Harness replays the
indexing with crafted controller-supplied bus/target against the real
allocation geometry.

## Build & run
```
./build.sh && ./run.sh
```

## Expected
Harness computes the OOB offset for out-of-range bus/target and confirms the
write/deref lands outside the allocated `ciss_logical` table.