--- baseline (unfixed replica) ---
== DF-3728 ciss_notify_complete dangling periodic_notify ==

step1: notify chain started, periodic_notify=tag1, posts=1

    notify_complete: fatal status 5 -> release_request(cr)
    (ciss.c:3624 releases; ciss.c:3625 clears NOTIFY_OK;
     ciss_periodic_notify is NOT cleared — dangling)
step2: fatal completion done; periodic_notify = dangling (request back on freeq)

step3: CAM I/O reuses tag1 (data=0x52200000), posts=1

step4: ciss_periodic -> ciss_notify_event uses stale pointer:
       tag1 now posts=3 (DOUBLE POST), data=0x52200000 (CAM's buffer kept: 0x1), completions so far=1

step5: two completions delivered -> CAM callback (xpt_done) ran 3 time(s) for ONE ccb

[BUG REPRODUCED] double-ownership of ciss_request tag1:
  - re-posted while in flight by CAM (posts=3)
  - CAM ccb completed twice (xpt_done x3 => CAM UAF)
  - notify CDB/preen clobbered the in-flight CAM command
RUN_EXIT=0
--- fixed replica (-DFIXED) ---
== DF-3728 ciss_notify_complete dangling periodic_notify ==

step1: notify chain started, periodic_notify=tag1, posts=1

    notify_complete: fatal status 5 -> release_request(cr)
    (ciss.c:3624 releases; ciss.c:3625 clears NOTIFY_OK;
     ciss_periodic_notify is NOT cleared — dangling)
step2: fatal completion done; periodic_notify = NULL (cleared)
       (with the fix the pointer is cleared — no dangling reuse)

RUN_EXIT=0
OVERALL_EXIT=1