--- baseline (unfixed replica) ---
== DF-3730 ciss_cam_complete_fixup padstr overflow ==
CAM client INQUIRY: dxfer_len=36 (passes the ciss.c:3305 gate >= 36)

    buffer[32..47] = 66 61 69 6c 65 64 20 20 20 20 20 20 20 20 20 20 
    canary  [36..47] was 0xc0..0xcb

[BUG REPRODUCED] 12 bytes written past the end of the 36-byte INQUIRY data
buffer (revision field is 4 bytes at offset 32; padstr writes 16).
Kernel impact: 12-byte heap overflow past a kmalloc'd CAM buffer with
status-string content (root/operator via CAM pass-through).
    write at buffer+36 (>= 36)
RUN_EXIT=0
--- fixed replica (-DFIXED) ---
== DF-3730 ciss_cam_complete_fixup padstr overflow ==
CAM client INQUIRY: dxfer_len=36 (passes the ciss.c:3305 gate >= 36)

    buffer[32..47] = 66 61 69 6c c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb 
    canary  [36..47] was 0xc0..0xcb

[FIXED] revision padstr bounded to SID_REVISION_SIZE (4): no bytes past the buffer.
RUN_EXIT=0
OVERALL_EXIT=1