{
  "finding_id": "DF-3732",
  "status": "inconclusive",
  "reproduced": 0,
  "impact": "none",
  "confidence": "likely",
  "verdict": "INCONCLUSIVE at runtime (no HP Smart Array PCI device on the guest - env.txt), source-certain: sc->ciss_perf is computed as cbase+cofs+cfg->transport_offset (ciss.c:694-695) from an unvalidated firmware u32 (only the config table itself is checked at ciss.c:646) and ciss_init_perf writes the fetch table/queue config through it (ciss.c:926-946) -> arbitrary-offset write relative to the BAR on malicious/buggy hardware. Low severity (malicious-hardware threat model). Upstream-inherited.",
  "exploit_chain": "malicious/corrupted controller config table -> transport_offset out of window -> ciss_init_perf writes OOB of mapping",
  "evidence": "VERDICT.md path analysis; env.txt (no HP PCI devices); fix_apply.log + fix_build.log",
  "kernel_refs": [
    "sys/dev/raid/ciss/ciss.c:646",
    "sys/dev/raid/ciss/ciss.c:694",
    "sys/dev/raid/ciss/ciss.c:926",
    "sys/dev/raid/ciss/ciss.c:941",
    "sys/dev/raid/ciss/cissreg.h:414"
  ],
  "poc_changes": "no runnable PoC possible without the device; source-level pack",
  "attempts": 1,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 1,
  "build_cmd": "(none - source-level pack)",
  "run_cmd": "(none - source-level pack)",
  "code_hash": "eafc074c7b8b998ec87d1ce8b344f6631b00bce55b63e80ae7673a7ed091817d",
  "notes": "Guest has no HP Smart Array hardware (env.txt); harness-level verification per the established DF-1190 methodology. Guest dirtied by fix-validation patch build; vm.sh reset with-src run afterwards.",
  "recommended_fix": "validate cfg->transport_offset against the BAR window before mapping ciss_perf; else fall back to simple transport",
  "fix_status": "inconclusive",
  "fix_baseline_reproduced": 0,
  "fix_patched_reproduced": 0,
  "fix_verdict": "Bounds check added (cofs+transport_offset+sizeof(perf config) <= csize, else fall back to SIMPLE). Compile-validated only: -Werror module build with all 7 fixes, link rc=0. No behavioral run possible (hardware absent).",
  "fix_evidence": "fix.diff; fix_apply.log; fix_build.log"
}