--- baseline (unfixed replica, -O2) ---
== DF-3727 ciss_disable_adapter uninitialized STAILQ head ==
scenario: adapter heartbeat failed 3x (ciss.c:3389-3398) with 2 BUSY
requests; ciss_periodic -> ciss_disable_adapter (ciss.c:3395);
stack slot holding qh.stqh_last groomed to 0x51000000 by prior activity

run 1:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x0 (list integrity ok)
run 2:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x0 (list integrity ok)
run 3:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x0 (list integrity ok)

[NOT REPRODUCED] grooming did not land on the qh slot in this
build (stack layout shifted); see harness.O0 (unoptimized build).
--- baseline -O2 did not land the groom; retry -O0 ---
== DF-3727 ciss_disable_adapter uninitialized STAILQ head ==
scenario: adapter heartbeat failed 3x (ciss.c:3389-3398) with 2 BUSY
requests; ciss_periodic -> ciss_disable_adapter (ciss.c:3395);
stack slot holding qh.stqh_last groomed to 0x51000000 by prior activity

run 1:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)  <== UNINITIALIZED STACK SLOT
    post-enqueue stqh_first = 0x51000000 (list integrity BROKEN (garbage head))
    [WILD WRITE] *(0x51000000) = 0x4023c0 (kernel: request ptr)
run 2:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)  <== UNINITIALIZED STACK SLOT
    post-enqueue stqh_first = 0x51000000 (list integrity BROKEN (garbage head))
    [WILD WRITE] *(0x51000000) = 0x4023c0 (kernel: request ptr)
run 3:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)  <== UNINITIALIZED STACK SLOT
    post-enqueue stqh_first = 0x51000000 (list integrity BROKEN (garbage head))
    [WILD WRITE] *(0x51000000) = 0x4023c0 (kernel: request ptr)

[BUG REPRODUCED] 3/3 runs: STAILQ_INSERT_TAIL wrote the
request pointer THROUGH the uninitialized stqh_last to the
attacker-groomed address 0x51000000. In the kernel this is an
uncontrolled write of a kernel heap pointer to a
stack-garbage-controlled address (CWE-457 -> CWE-787).
RUN_EXIT=0
--- fixed replica (-DFIXED: STAILQ_INIT) ---
== DF-3727 ciss_disable_adapter uninitialized STAILQ head ==
scenario: adapter heartbeat failed 3x (ciss.c:3389-3398) with 2 BUSY
requests; ciss_periodic -> ciss_disable_adapter (ciss.c:3395);
stack slot holding qh.stqh_last groomed to 0x51000000 by prior activity

run 1:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x4022a0 (list integrity ok)
run 2:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x4022a0 (list integrity ok)
run 3:
    first-enqueue stqh_last = 0x0 (groomed target 0x51000000)
    post-enqueue stqh_first = 0x4022a0 (list integrity ok)

[FIXED] STAILQ_INIT(&qh) present: no write through garbage,
list head consistent, no watch-page hit.
RUN_EXIT=0
OVERALL_EXIT=0