# DF-1192 — ciss_filter_physical negative bus index -> OOB read+write

**File:** `sys/dev/raid/ciss/ciss.c:1551-1554`
**Class:** memory corruption (hardware/firmware-attacker; malicious CISS PCI device
or malicious VBIOS at driver attach). No local-unprivileged syscall trigger on the
audit guest (no HP Smart Array / no AMD GPU present).

## Reproduce
```sh
./build.sh && ./run.sh
```

## What the harness does
`harness.c` is a faithful userspace replica of the kernel parsing routine cited
above, fed crafted controller/VBIOS data that the real malicious device would
supply. It demonstrates the out-of-bounds access / overflow / underflow using the
**real kernel macros and struct sizes**, with a canary or computed-index check to
make the OOB observable without needing the hardware.

## Expected output
A `[BUG REPRODUCED]` (or `UNDERFLOW` for DF-1199) marker plus the computed
out-of-range index / overflow byte count / underflowed loop count. See `run.log`
for the captured decisive run.

## Fix
See `fix.diff` (git-apply-able) and `VERDICT.md`. The fix was validated to
compile (module rebuilt with `-Werror`) — see `fix_build.log`. No live-kernel
trigger exists on the guest, so the fix is validated at the
applies + compiles + closes-the-code-path level.

## Artifacts
`VERDICT.md` (full narrative), `harness.c`, `build.sh`, `run.sh`,
`run.log`, `env.txt`, `fix.diff`, `fix_build.log`, `manifest.json`.