{
  "finding_id": "DF-3728",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "REPRODUCED (harness-level; firmware-gated path): the fatal-error exit of ciss_notify_complete (ciss.c:3619-3627) releases the notify request without clearing sc->ciss_periodic_notify (sibling exits clear it at 3648/3653). The next ciss_periodic tick restarts the chain via the stale pointer (ciss.c:3526): the request, by then re-allocated to a CAM I/O, is preened/CDB-clobbered and POSTED A SECOND TIME (ciss.c:3550,3579); both completions run the CAM callback -> xpt_done(ccb) multiple times for one ccb (ciss.c:3286) and double-release the request onto ciss_free -> STAILQ corruption / CAM UAF.",
  "exploit_chain": "fatal notify status -> dangling periodic_notify -> free-list reuse by CAM -> double post + command clobber -> double completion -> xpt_done x2+ / double free-queue insertion",
  "evidence": "run.log step4 posts=3 (DOUBLE POST), step5 CAM callback ran 3x for ONE ccb, [BUG REPRODUCED]; fix_run.log shows pointer cleared",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:3619",
    "sys/dev/raid/ciss/ciss.c:3624",
    "sys/dev/raid/ciss/ciss.c:3526",
    "sys/dev/raid/ciss/ciss.c:3550",
    "sys/dev/raid/ciss/ciss.c:3579",
    "sys/dev/raid/ciss/ciss.c:2176",
    "sys/dev/raid/ciss/ciss.c:3286"
  ],
  "poc_changes": "harness written fresh; initial FIXED-path printf dereferenced the NULL pointer - fixed to print the cleared state",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 1,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "5d463636856c419b9c6ab1d06700ef445f0b843be539dc94b70be259813e130c",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "clear sc->ciss_periodic_notify before ciss_release_request in the notify fatal-error path",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "sc->ciss_periodic_notify = NULL added before release in the fatal path. Module rebuilt at -Werror with all 7 fixes; -DFIXED replica clears the pointer and restarts on a fresh request.",
  "fix_evidence": "fix.diff; fix_apply.log; fix_build.log; fix_run.log (periodic_notify = NULL (cleared))"
}