{
  "finding_id": "DF-3727",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "REPRODUCED (harness-level; hardware-gated path): ciss_disable_adapter (ciss.c:3465) never STAILQ_INITs its local cr_qhead_t qh; the first ciss_enqueue_complete (ciss.c:3483 == STAILQ_INSERT_TAIL, queue.h:306, no NULL guard) writes the ciss_request kernel pointer through the uninitialized stack slot qh.stqh_last, and the dequeue loop dereferences the garbage stqh_first. Reached from ciss_periodic after 3 failed 10s heartbeats with >=1 BUSY request (ciss.c:3389-3398,3395). FreeBSD upstream has STAILQ_INIT(&qh) (upstream ciss.c:3581) - DF-only divergence. Harness: 3/3 runs land a request-pointer wild write at the stack-groomed address; gcc itself warns -Wuninitialized (build.log).",
  "exploit_chain": "adapter wedge (heartbeat x3) -> ciss_disable_adapter -> *(garbage stqh_last)=&ciss_request[i] wild write -> panic..exploitation depending on stack grooming; wild read on dequeue",
  "evidence": "run.log lines with [WILD WRITE] *(0x51000000)=0x4023c0 and [BUG REPRODUCED]; build.log gcc -Wuninitialized; fix_run.log [FIXED]; VERDICT.md",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:3465",
    "sys/dev/raid/ciss/ciss.c:3483",
    "sys/dev/raid/ciss/ciss.c:3487",
    "sys/dev/raid/ciss/ciss.c:3389",
    "sys/dev/raid/ciss/ciss.c:3395",
    "sys/sys/queue.h:306"
  ],
  "poc_changes": "harness written fresh (no seed); -O2 build shifts the frame so the deterministic -O0 build is the default demonstration",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 90,
  "guest_dirty": 1,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "2013f8c97155a90aaef495bac6228952c8fecc7cc226c176cc31fb3990d7f039",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "add STAILQ_INIT(&qh) in ciss_disable_adapter (matches FreeBSD upstream)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "STAILQ_INIT(&qh) added (matches FreeBSD upstream ciss.c:3581). Module rebuilt with all 7 ciss fixes at -Werror (link rc=0); -DFIXED harness replica shows no write through garbage and consistent list head.",
  "fix_evidence": "fix.diff; fix_apply.log (clean dry-run); fix_build.log (-Werror, ciss.ko link ok); fix_run.log ([FIXED] marker)"
}