# DF-3730 — ciss_cam_complete_fixup: padstr writes 16 bytes into the 4-byte INQUIRY revision field

**File:** `sys/dev/raid/ciss/ciss.c:3325`
(`padstr(inq->revision, ciss_name_ldrive_status(...), 16);` —
`struct scsi_inquiry_data.revision` is `char[4]` at buffer offset 32,
scsi_all.h:738-739). Gate is only `csio->dxfer_len >= SHORT_INQUIRY_LENGTH`
(36) at ciss.c:3305 → 12 bytes past a 36-byte CAM data buffer.

**Class:** kernel heap OOB write (CWE-787), CAM-pass-through reachable
(root/operator; /dev/passN is 0600 root:operator, scsi_pass.c:279-281).
Upstream-inherited.

## Reproduce
```sh
./build.sh && ./run.sh
```

## Expected output
Baseline: `write at buffer+36 (>= 36)` … `[BUG REPRODUCED] 12 bytes written
past the end of the 36-byte INQUIRY data buffer`. Fixed replica
(`-DFIXED` = `sizeof(inq->revision)`): canary intact, `[FIXED]`.

## Fix
`fix.diff` (bound the revision padstr to the field size). Compile-validated
with the other 6 ciss fixes at `-Werror` (`fix_build.log`); behaviorally
validated by the `-DFIXED` run.

## Artifacts
`VERDICT.md`, `harness.c`, `build.sh`, `run.sh`, `build.log`, `run.log`,
`run.2.log`, `run.3.log`, `env.txt`, `fix.diff`, `fix_apply.log`,
`fix_build.log`, `manifest.json`, `verdict.json`.