{
  "finding_id": "DF-3731",
  "status": "reproduced",
  "reproduced": 1,
  "impact": "dos",
  "confidence": "certain",
  "verdict": "REPRODUCED (harness-level): cpi->max_target = CISS_MAX_LOGICAL (15) (ciss.c:2956) while ciss_logical rows hold exactly 15 entries (ciss.c:1377-1379); CAM scans targets 0..max_target INCLUSIVE (cam_xpt.c:5382), so every bus scan reads ciss_logical[bus][15].cl_status one struct past the row kmalloc (ciss.c:3159/2923). Certain recurring OOB read; deeper wild-pointer deref in ciss_cam_complete_fixus is heap-layout-dependent -> Low severity. Distinct from DF-1194 (bus-row <= off-by-one).",
  "exploit_chain": "every CAM scan -> probe target 15 -> OOB read of phantom row -> normally SEL_TIMEOUT; garbage ONLINE would deref phantom cl_ldrive",
  "evidence": "run.log: probe target 15 ... <== OOB (past row alloc), [BUG REPRODUCED] 1 OOB read; fix_run.log all probes in bounds",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:2956",
    "sys/dev/raid/ciss/ciss.c:1377",
    "sys/dev/raid/ciss/ciss.c:3159",
    "sys/dev/raid/ciss/ciss.c:2923",
    "sys/bus/cam/cam_xpt.c:5382"
  ],
  "poc_changes": "harness written fresh",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 45,
  "guest_dirty": 1,
  "build_cmd": "./build.sh",
  "run_cmd": "./run.sh",
  "code_hash": "731d31073cc1fc849ba0f788cae8b15accf2fb64f1ee366a60afaa0537b568c0",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "set cpi->max_target = CISS_MAX_LOGICAL - 1",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "max_target = CISS_MAX_LOGICAL - 1. -Werror module build + -DFIXED replica: all probes in bounds.",
  "fix_evidence": "fix.diff; fix_apply.log; fix_build.log; fix_run.log [FIXED]"
}