--- baseline (unfixed replica) ---
== DF-3731 ciss max_target off-by-one vs ciss_logical rows ==
ciss_logical[bus] row = 360 bytes (15 entries), cpi->max_target = 15
CAM scan: for (i = 0; i <= max_target; i++)  (cam_xpt.c:5382)

  probe target  0: read ciss_logical[0][ 0].cl_status = 0   
  probe target  1: read ciss_logical[0][ 1].cl_status = 0   
  probe target  2: read ciss_logical[0][ 2].cl_status = 0   
  probe target  3: read ciss_logical[0][ 3].cl_status = 1   
  probe target  4: read ciss_logical[0][ 4].cl_status = 0   
  probe target  5: read ciss_logical[0][ 5].cl_status = 0   
  probe target  6: read ciss_logical[0][ 6].cl_status = 0   
  probe target  7: read ciss_logical[0][ 7].cl_status = 0   
  probe target  8: read ciss_logical[0][ 8].cl_status = 0   
  probe target  9: read ciss_logical[0][ 9].cl_status = 0   
  probe target 10: read ciss_logical[0][10].cl_status = 0   
  probe target 11: read ciss_logical[0][11].cl_status = 0   
  probe target 12: read ciss_logical[0][12].cl_status = 0   
  probe target 13: read ciss_logical[0][13].cl_status = 0   
  probe target 14: read ciss_logical[0][14].cl_status = 0   
  probe target 15: read ciss_logical[0][15].cl_status = 0   <== OOB (past row alloc)

[BUG REPRODUCED] 1 OOB read(s) of ciss_logical[bus][15] — one struct past the row
allocation, executed on every CAM bus scan. Deeper impact (garbage ONLINE ->
cl_ldrive/cl_lstatus wild deref in ciss_cam_complete_fixup) is heap-layout-dependent.
RUN_EXIT=0
--- fixed replica (-DFIXED) ---
== DF-3731 ciss max_target off-by-one vs ciss_logical rows ==
ciss_logical[bus] row = 360 bytes (15 entries), cpi->max_target = 14
CAM scan: for (i = 0; i <= max_target; i++)  (cam_xpt.c:5382)

  probe target  0: read ciss_logical[0][ 0].cl_status = 0   
  probe target  1: read ciss_logical[0][ 1].cl_status = 0   
  probe target  2: read ciss_logical[0][ 2].cl_status = 0   
  probe target  3: read ciss_logical[0][ 3].cl_status = 1   
  probe target  4: read ciss_logical[0][ 4].cl_status = 0   
  probe target  5: read ciss_logical[0][ 5].cl_status = 0   
  probe target  6: read ciss_logical[0][ 6].cl_status = 0   
  probe target  7: read ciss_logical[0][ 7].cl_status = 0   
  probe target  8: read ciss_logical[0][ 8].cl_status = 0   
  probe target  9: read ciss_logical[0][ 9].cl_status = 0   
  probe target 10: read ciss_logical[0][10].cl_status = 0   
  probe target 11: read ciss_logical[0][11].cl_status = 0   
  probe target 12: read ciss_logical[0][12].cl_status = 0   
  probe target 13: read ciss_logical[0][13].cl_status = 0   
  probe target 14: read ciss_logical[0][14].cl_status = 0   

[FIXED] max_target = CISS_MAX_LOGICAL - 1: all probes in bounds.
RUN_EXIT=0
OVERALL_EXIT=1