BUILD_EXIT=0
-rwxr-xr-x  1 maxx  maxx  8760 Jul 17 06:46 harness
----- RUN -----
=== DF-1189: ciss_notify_logical OOB on ciss_logical[bus][15] ===
allocation: [1][15]  total ldrive slots = 15
benign  bus=0 target=5  -> cl_status=65 (in-bounds)

[*] crafted controller: bus=0 logical_drive=40
[!] ld = &ciss_logical[0][40] = 1600 bytes past row start, 1000 bytes PAST allocation end
[!] kernel would WRITE cl_status/cl_update and DEREF cl_lstatus there -> OOB write+read

[*] crafted controller: bus=10 logical_drive=3
[!] ciss_logical[10] is 80 bytes past ciss_logical[0] in the pointer array
[!] -> dereferences an attacker-influenced pointer as a ciss_ldrive (type confusion + OOB)

[*] worst case: logical_drive=65535 -> 2621400 bytes past row start (alloc is 600 bytes)

[+] DF-1189 CONFIRMED: bus/target from controller notify index ciss_logical[bus][target] with no bounds check.
RUN_EXIT=0