DF-0021 PoC run on UNPATCHED 6.5-DEVELOPMENT #0 kernel (with-src baseline)
Command: kldload /root/poc_shift/poc_shift.ko (as root)
Method: module-based trigger (root→kernel; no unprivileged trigger known — LATENT bug)

dmesg output from module load:
---
poc: allocating 2147483648 bytes (2 GiB, oversized)
poc: got 2 GiB @ 0xfffff801185e0000
poc: kmalloc_usable_size = 0xffffffff80000000 (expect 0x0000000080000000 if OK)
poc: BUG CONFIRMED (line 1261): usable_size overflowed!
poc: now kfree — on buggy kernel expect panic here
poc: kfree returned OK (fixed kernel)
---

Analysis:
- kmalloc_usable_size (line 1261): *kup << PAGE_SHIFT overflows signed int.
  *kup = 0x80000 (524288), 0x80000 << 12 = 0x80000000 = INT_MIN (signed UB).
  Sign-extended to unsigned long: 0xFFFFFFFF80000000.
  Expected (correct): 0x0000000080000000.
  => BUG CONFIRMED: wrong size returned to any caller that trusts it.

- kfree path (line 1432): same overflow; size = 0xFFFFFFFF80000000.
  kmem_slab_free(ptr, 0xFFFFFFFF80000000) -> vm_map_remove(kernel_map, ptr, ptr+size).
  ptr + 0xFFFFFFFF80000000 wraps to a value LESS than ptr (start > end).
  vm_map_remove silently returns without removing the mapping => 2 GiB KVA/page leak.
  No panic on this path, but silent resource leak.

- krealloc path (line 1202): not exercised because the 4 GiB krealloc hits the
  per-type ks_limit check (panic "malloc limit exceeded") before reaching the
  line-1202 overflow. The line-1202 overflow is confirmed by source inspection.

Guest survived (no panic on the direct alloc/free path). kldload exit=1 (normal
for DragonFlyBSD module load with output). Guest still UP after the test.