# DF-3728 — ciss_notify_complete fatal-error path leaves ciss_periodic_notify dangling → double-ownership / double completion of a ciss_request

**File:** `sys/dev/raid/ciss/ciss.c:3619-3627` (fatal path releases the
request but does NOT clear `sc->ciss_periodic_notify`; the two sibling exit
paths DO clear it: ciss.c:3648 and ciss.c:3653).

**Class:** use-after-free-style request lifetime bug (double ownership →
double post → double completion → `xpt_done(ccb)` twice → CAM UAF),
CWE-672/DF-3672-family "CCB lifetime" lesson.

## Reproduce
```sh
./build.sh && ./run.sh
```

## Expected output
Baseline: step4 shows the CAM-owned request re-posted by the notify chain
(`posts=3`), step5 shows the CAM callback running 3× for ONE ccb, and
`[BUG REPRODUCED]`. Fixed replica (`-DFIXED` = clear the pointer in the
fatal path): `periodic_notify = NULL (cleared)`, no reuse.

## Trigger (kernel)
Adapter returns a fatal status (≠ SUCCESS/TARGET_STATUS/TIMEOUT — e.g.
`CISS_CMD_STATUS_PROTOCOL_ERROR`, `HARDWARE_ERROR`) for the Notify-on-Event
command; 10 s later `ciss_periodic` (ciss.c:3427-3430) restarts the chain
through the stale pointer.

## Fix
`fix.diff` (clear `ciss_periodic_notify` before releasing). Compile-validated
with the other 6 ciss fixes at `-Werror` (`fix_build.log`); behaviorally
validated by the `-DFIXED` harness run.

## Artifacts
`VERDICT.md`, `harness.c`, `build.sh`, `run.sh`, `build.log`, `run.log`,
`run.2.log`, `run.3.log`, `env.txt`, `fix.diff`, `fix_apply.log`,
`fix_build.log`, `manifest.json`, `verdict.json`.