# DF-3733 — ciss_periodic/ciss_free teardown race: callout re-armed after callout_stop → post-free execution of ciss_periodic

**File:** `sys/dev/raid/ciss/ciss.c:3431-3436` (`ciss_periodic` releases
`ciss_lock`, **then** calls `callout_reset`) vs `ciss_free` ciss.c:1874
(`callout_stop` under the lock) and ciss.c:1902-1908 (lock released,
`callout_terminate`, `lockuninit`, then the softc is torn down).

**Class:** detach-vs-callout race → use-after-free execution of
`ciss_periodic` on a freed softc (CWE-362/DF-3672-family callout
discipline). Requires privileged detach (kldunload/devctl) racing the 10 s
heartbeat tick — Low severity.

## Verification status
Source-level analysis; **inconclusive at runtime** — no CISS hardware on the
guest, and the race needs a real controller detach to have a meaningful
window (env.txt). The fix applies the `callout_init_lk` discipline validated
in the mpt/arcmsr findings.

## Fix
`fix.diff` (5 hunks: `callout_init_lk(&sc->ciss_periodic, &sc->ciss_lock)`,
handler no longer takes/drops the lock itself, attach-time direct call
wrapped). Compile-validated with the other 6 fixes at `-Werror`
(`fix_build.log`, `fix_apply.log`).

## Artifacts
`VERDICT.md`, `fix.diff`, `fix_apply.log`, `fix_build.log`, `env.txt`,
`manifest.json`, `verdict.json`.