# DF-3731 — XPT_PATH_INQ max_target off-by-one: CAM probes target 15 into the 15-entry ciss_logical rows

**File:** `sys/dev/raid/ciss/ciss.c:2956` (`cpi->max_target =
CISS_MAX_LOGICAL;` = 15) vs row allocation of exactly `CISS_MAX_LOGICAL`
entries, indices 0..14 (ciss.c:1377-1379). CAM's bus scan iterates
`for (i = 0; i <= max_target; i++)` — INCLUSIVE
(`sys/bus/cam/cam_xpt.c:5382`), so target 15 is probed on every scan and
`sc->ciss_logical[bus][15].cl_status` is read one struct past the row
allocation (`ciss_cam_emulate`, ciss.c:3159; `XPT_CALC_GEOMETRY`,
ciss.c:2923).

**Class:** recurring heap OOB read (CWE-125) on every bus scan/boot;
heap-layout-dependent deeper impact (garbage ONLINE → wild
`cl_ldrive`/`cl_lstatus` deref in `ciss_cam_complete_fixup`, ciss.c:3321-3325).
Distinct from DF-1194 (that one is the bus-row `<=` in init/free; this one
is the target-column off-by-one against CAM's inclusive scan).

## Reproduce
```sh
./build.sh && ./run.sh
```

## Expected output
Baseline: `probe target 15: read ciss_logical[0][15].cl_status ... <== OOB`
and `[BUG REPRODUCED] 1 OOB read(s)`. Fixed replica (`-DFIXED` =
`max_target = CISS_MAX_LOGICAL - 1`): all probes in bounds.

## Fix
`fix.diff` (one line). Compile-validated with the other 6 ciss fixes at
`-Werror` (`fix_build.log`); behaviorally validated by the `-DFIXED` run.

## Artifacts
`VERDICT.md`, `harness.c`, `build.sh`, `run.sh`, `build.log`, `run.log`,
`run.2.log`, `run.3.log`, `env.txt`, `fix.diff`, `fix_apply.log`,
`fix_build.log`, `manifest.json`, `verdict.json`.