== DF-1190 ciss_init_logical OOB index harness ==
ciss_max_logical_bus=1, CISS_MAX_LOGICAL=15

[!] OOB index drive=0 bus=200 (max 1) target=250 (max 15) -> writes ciss_logical[200][250] + ciss_controllers+200
[!] OOB index drive=1 bus=0 (max 1) target=40 (max 15) -> writes ciss_logical[0][40] + ciss_controllers+0

[BUG REPRODUCED] 2 out-of-range index accesses observed
On a real kernel these become:
  - ciss_logical[bus] : OOB pointer deref (arbitrary kmalloc target)
  - ciss_controllers[bus] : OOB kernel pointer written into ld->cl_controller
  - ciss_identify_logical then kmallocs into OOB ld->cl_ldrive/cl_lstatus
RUN_EXIT=0