DF-0021 PoC re-run on PATCHED single-fix kernel (#1)
Command: kldload /root/poc_shift/poc_shift.ko (as root)
Fix applied: (size_t)*kup << PAGE_SHIFT at kern_slaballoc.c:1202,1261,1432

dmesg output from module load on PATCHED kernel:
---
poc: allocating 2147483648 bytes (2 GiB, oversized)
poc: got 2 GiB @ 0xfffff80118440000
poc: kmalloc_usable_size = 0x0000000080000000 (expect 0x0000000080000000 if OK)
poc: now kfree — on buggy kernel expect panic here
poc: kfree returned OK (fixed kernel)
---

RESULT: On the patched kernel, kmalloc_usable_size returns the CORRECT value
0x0000000080000000 (2 GiB), matching the expected size. No overflow. No
"BUG CONFIRMED" message. kfree also returned cleanly (proper vm_map_remove
with correct size, no KVA leak).

Contrast with baseline (#0 unpatched):
  kmalloc_usable_size = 0xffffffff80000000 (OVERFLOWED) → 0x0000000080000000 (CORRECT)

FIX STATUS: fixed — the signed-shift overflow is eliminated by the (size_t) cast.