# DF-3727 — ciss_disable_adapter: uninitialized STAILQ head → wild kernel write

**File:** `sys/dev/raid/ciss/ciss.c:3465` (`cr_qhead_t qh;` never `STAILQ_INIT`'d),
used at `ciss.c:3483` (`ciss_enqueue_complete(cr, &qh)` == `STAILQ_INSERT_TAIL`,
`sys/sys/queue.h:306` — **no NULL guard**: `*(head)->stqh_last = (elm)`).

**Class:** kernel memory corruption via uninitialized stack variable
(CWE-457 → CWE-787/CWE-824). DragonFly-only divergence: FreeBSD's
`ciss_disable_adapter` has `STAILQ_INIT(&qh);` (upstream ciss.c:3581).

**Trigger:** adapter heartbeat unchanged for 3 consecutive 10 s checks
(`ciss_periodic`, ciss.c:3389-3398) with ≥1 BUSY request →
`ciss_disable_adapter` (ciss.c:3395). The guest has no HP Smart Array
hardware, so — per the established methodology (cf. DF-1190) — the primitive
is proven with a faithful userspace harness replica using the exact
queue.h macro text and stack grooming.

## Reproduce
```sh
./build.sh && ./run.sh
```

## Expected output
Baseline: `[WILD WRITE] *(0x51000000) = <request ptr>` and
`[BUG REPRODUCED]` — `STAILQ_INSERT_TAIL` wrote the request pointer through
the *uninitialized* `qh.stqh_last` (stack garbage groomed to 0x51000000).
The `-O0` build lands the groom deterministically (3/3 runs); gcc itself
warns `'qh.stqh_last' is used uninitialized` on the -O2 build (see build.log).
Fixed replica (`-DFIXED` = `STAILQ_INIT(&qh)`): no write through garbage,
list consistent, `[FIXED]` marker.

## Fix
`fix.diff` (one line, matches FreeBSD upstream). Validated: applies cleanly,
`ciss.ko` rebuilt with all 7 ciss fixes at `-Werror` (fix_build.log), and the
`-DFIXED` harness run shows the wild write gone. No live-kernel trigger
exists on the audit guest (no CISS controller).

## Artifacts
`VERDICT.md`, `harness.c`, `build.sh`, `run.sh`, `build.log`, `run.log`,
`run.2.log`, `run.3.log`, `env.txt`, `fix.diff`, `fix_apply.log`,
`fix_build.log`, `manifest.json`, `verdict.json`.