# DF-5551 — camq_insert() into a full queue writes one pointer past the array (guard is DIAGNOSTIC-only)

**File:** `sys/bus/cam/cam_queue.c:145-157`
**Severity:** Medium
**Evidence:** harness test T3 in `findings/poc/DF-5550/` (same file, same
root-cause family, same harness; fix hunk included in DF-5550's fix.diff).

The full-queue guard at cam_queue.c:148-151 is `#ifdef DIAGNOSTIC` —
compiled out of every stock kernel.  On a full queue the insert writes
`queue_array[array_size+1]` (a kernel pointer **one slot past the kmalloc'd
array**) and sets `entries = array_size+1`; heap_up/heap_down then walk
out-of-bounds slots on every later operation.

Reachability standalone: any accounting drift that lets a caller exceed
capacity — e.g. the DF-5550 corrupted state (`entries > array_size`
persists after an unguarded shrink, so *every* subsequent insert writes
OOB), or ccbq/devq opening miscounts under the split-lock design (devq
mutated under `xpt_topo_lock` in xpt_alloc_device/xpt_release_device,
everything else under the per-sim lock; `struct camq` itself carries no
lock, cam_queue.h:46-52).

Proof (guest, stock kernel, production primitives):

```
[CAMQTEST] T3 inserting 5th entry into 4-capacity queue (guard is DIAGNOSTIC-only)...
[CAMQTEST] T3 after: entries=5 array_size=4 (wrote queue_array[5] == 0xfffff8008d403fb0 PAST the array)
[CAMQTEST] T3: canary 63 (0xfffff8008d482500) CORRUPTED at +0: 80 (was a5)
[CAMQTEST] T3: 1 CANARY(IES) OVERWRITTEN -> heap OOB WRITE proven
```

Fix: unconditional refusal (see DF-5550 fix.diff hunk 2).