# DF-3732 — ciss_init_pci: firmware-controlled transport_offset maps the Performant table outside the BAR window; ciss_init_perf writes through it

**File:** `sys/dev/raid/ciss/ciss.c:692-695` —
`sc->ciss_perf = (struct ciss_perf_config *)(cbase + cofs +
sc->ciss_cfg->transport_offset);` with **no** bound on
`transport_offset` (the config-table check at ciss.c:646 validates only
`cofs + sizeof(struct ciss_config_table) <= csize`).
`ciss_init_perf` then **writes** the fetch table, queue sizes and reply-queue
address through that pointer (ciss.c:926-946).

**Class:** OOB write relative to the mapped BAR (CWE-787), fully
firmware/PCIe-device controlled (malicious or corrupted controller memory /
spoofed Smart Array on external PCIe). Upstream-inherited (FreeBSD has the
identical code). Severity Low (malicious-hardware threat model; no
unprivileged-local or remote trigger).

## Verification status
Source-level certainty; **inconclusive at runtime** — the audit guest has no
HP Smart Array PCI device (env.txt), so neither the vulnerable mapping nor
the fix can be exercised live. The one-line bounds check in `fix.diff`
mirrors the existing `ciss.c:646` pattern.

## Fix
`fix.diff` (validate `cofs + transport_offset + sizeof(struct ciss_perf_config)
<= csize`, else fall back to the simple transport). Compile-validated:
applied together with the 6 other ciss pass-2 fixes, `ciss.ko` rebuilt at
`-Werror`, link rc=0 (`fix_build.log`, `fix_apply.log`).

## Artifacts
`VERDICT.md`, `fix.diff`, `fix_apply.log`, `fix_build.log`, `env.txt`,
`manifest.json`, `verdict.json`.