{
  "finding_id": "DF-3730",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "corruption",
  "confidence": "certain",
  "verdict": "REPRODUCED (harness-level): ciss_cam_complete_fixup pads inq->revision (4-byte field, offset 32) with 16 bytes (ciss.c:3325) gated only by dxfer_len >= 36 (ciss.c:3305) -> 12-byte heap overflow past a 36-byte CAM INQUIRY buffer, reachable via CAM pass-through (/dev/passN 0600 root:operator). Severity Low (privileged reach, semi-fixed string content); upstream-inherited.",
  "exploit_chain": "CAM pass INQUIRY with 36-byte buffer on an ONLINE logical target -> completion fixup padstr(16) at offset 32 -> 12 bytes past kmalloc",
  "evidence": "run.log: write at buffer+36, [BUG REPRODUCED] 12 bytes past the 36-byte buffer; fix_run.log canary intact",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:3325",
    "sys/dev/raid/ciss/ciss.c:3305",
    "sys/bus/cam/scsi/scsi_all.h:738",
    "sys/bus/cam/scsi/scsi_all.h:652",
    "sys/dev/raid/ciss/cissvar.h:374"
  ],
  "poc_changes": "harness written fresh; padstr instrumented with offset-checking stores",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 1,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "fd4bd0869e844bba2f8b781a20ab36840b80cf597285dc20eb5de44b2ae14d03",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "bound the revision padstr to sizeof(inq->revision) (4 bytes)",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "revision padstr bounded to sizeof(inq->revision) (4). -Werror module build + -DFIXED replica shows canary intact.",
  "fix_evidence": "fix.diff; fix_apply.log; fix_build.log; fix_run.log [FIXED]"
}