== DF-1192 ciss_filter_physical negative-bus harness ==
ciss_max_physical_bus=4

[malicious] BUS2= 0 target= 5 -> index bus=-1 (valid 0..3) target=5
[benign   ] BUS2= 2 target= 5 -> index bus=1 (valid 0..3) target=5

[BUG REPRODUCED] malicious LUN PASSES the filter and indexes ciss_physical[-1][5]
On a real kernel: ciss_physical[-1] reads a kernel pointer from before
the array; the subsequent cp_address/cp_online writes corrupt whatever
that pointer references (controlled OOB write).
RUN_EXIT=0