# DF-2413 fix (authored post-verification; not applied to sys/)
Covered by the DF-4349 fix (bounds + ACCB_ACTIVE validation of
ccb_index before ccb_infos[] dereference in adv_run_doneq /
advlib.c:1988); see findings/poc/DF-4349/fix.diff.  An equivalent
minimal guard:

--- a/sys/dev/disk/advansys/advansys.c
+++ b/sys/dev/disk/advansys/advansys.c
@@ -1106,6 +1106,10 @@ adv_run_doneq(struct adv_softc *adv)
 ...
 		cinfo = &adv->ccb_infos[scsiq.d2.ccb_index];
+		if (scsiq.d2.ccb_index >= adv->ccb_infos_allocated ||
+		    cinfo->state != ACCB_ACTIVE) {
+			/* drop bogus completion */
+			continue;
+		}
 		ccb = cinfo->ccb;