# DF-3731 VERDICT

## Finding
`ciss_cam_action(XPT_PATH_INQ)` advertises

```c
    /* sys/dev/raid/ciss/ciss.c:2956 */
    cpi->max_target = CISS_MAX_LOGICAL;      /* 15 */
```

but each `sc->ciss_logical[bus]` row is allocated with exactly
`CISS_MAX_LOGICAL` entries (ciss.c:1377-1379) — valid indices 0..14, with
target 15 being the driver's own `initiator_id` (ciss.c:2958). CAM semantics
treat `max_target` as INCLUSIVE: the bus scan is

```c
    /* sys/bus/cam/cam_xpt.c:5382 */
    for (i = 0; i <= max_target; i++)
```

so every rescan probes target 15, and the SIM reads

- `sc->ciss_logical[bus][15].cl_status` in `ciss_cam_emulate` (ciss.c:3159),
- `sc->ciss_logical[bus][target]` in `XPT_CALC_GEOMETRY` (ciss.c:2923),

one `struct ciss_ldrive` past the row kmalloc — a recurring heap OOB read
executed at every boot/rescan on every machine with this controller.

## Impact ceiling (speculative, heap-layout dependent)
If the adjacent heap object happens to contain `CISS_LD_ONLINE` (1) at the
`cl_status` offset of the phantom row, the probe proceeds to real I/O and
`ciss_cam_complete_fixup` (ciss.c:3321-3325) dereferences the phantom row's
`cl_ldrive`/`cl_lstatus` garbage pointers. With `kmalloc(..., M_ZERO)`
neighbours the value is 0 (NONEXISTENT → clean SEL_TIMEOUT), so the
observable effect is normally benign — hence Low severity with the OOB read
itself certain.

## Verification (no HP Smart Array on the audit guest)
`harness.c` models the inclusive CAM scan over a canary-backed 15-entry row:
- baseline (`run.log`, stable in run.2/run.3): `probe target 15 ... <== OOB`,
  `[BUG REPRODUCED] 1 OOB read(s)`;
- `-DFIXED` (`max_target = CISS_MAX_LOGICAL - 1`): 15 probes, all in bounds.

## Fix validation
- `fix.diff`: `cpi->max_target = CISS_MAX_LOGICAL - 1;`
- `fix_apply.log`: clean dry-run; `fix_build.log`: `ciss.ko` rebuilt with
  all 7 ciss fixes at `-Werror`, link rc=0; `-DFIXED` harness run clean.

**Bottom line: reproduced (harness-level); certain recurring OOB read,
speculative deeper impact; fix validated at compile + replica level.**

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.