{
  "finding_id": "DF-3729",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "REPRODUCED (harness-level; firmware-gated path): ciss_notify_rescan_logical computes ndrives from the controller-written list_size with NO CISS_MAX_LOGICAL clamp (ciss.c:3866; the attach-time sibling checks it at ciss.c:1357) and indexes ciss_logical[bus][target] from CISS_LUN_TO_BUS/TARGET with no bounds check (ciss.c:3899-3901). Firmware-controlled heap OOB READ past the 15-LUN report buffer plus OOB WRITES (cl_update/cl_address/cl_controller and identify-time cl_ldrive/cl_lstatus pointer stores) up to 255 rows/cols out of range. Upstream-inherited; the pass-1 set (DF-1190) fixed only the attach-time copy.",
  "exploit_chain": "logical status-change notify -> rescan REPORT_LOGICAL_LUNS -> forged list_size/lun[] -> cll->lun[i] OOB read -> ciss_logical[bus][target] OOB writes",
  "evidence": "run.log: 226 OOB redzone reads (raw 0xffffffff -> bus=255 target=255) + 226 OOB index computations, [BUG REPRODUCED]; fix_run.log [FIXED] 0 OOB accesses",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:3866",
    "sys/dev/raid/ciss/ciss.c:3896",
    "sys/dev/raid/ciss/ciss.c:3899",
    "sys/dev/raid/ciss/ciss.c:3901",
    "sys/dev/raid/ciss/ciss.c:3906",
    "sys/dev/raid/ciss/ciss.c:1357",
    "sys/dev/raid/ciss/cissreg.h:509"
  ],
  "poc_changes": "harness written fresh; loop capped at 256 iterations for demo runtime (kernel loop is fully unbounded)",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 60,
  "guest_dirty": 1,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "789844f7cb96572c5997c2a9aab7e8a7237261bb22d4f29cb82d047714aabe84",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "clamp ndrives to CISS_MAX_LOGICAL and bounds-check bus/target in ciss_notify_rescan_logical (mirror ciss.c:1357)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Two hunks: clamp ndrives like ciss.c:1357 (free+return on absurd count) and reject bus/target outside ciss_max_logical_bus/CISS_MAX_LOGICAL. -Werror module build + -DFIXED replica clean (0 OOB).",
  "fix_evidence": "fix.diff (2 hunks); fix_apply.log; fix_build.log; fix_run.log [FIXED] 0 OOB accesses"
}