# DF-0083 — OOB write into cpu_topology_nodes[MAXCPU] at boot

| | |
|---|---|
| Verdict | **REPRODUCED (harness/code-level)** — boot-time, high-CPU-only |
| Impact | boot-time BSS corruption on >=170-CPU systems (not runtime on this 6-vCPU guest) |
| File | `sys/kern/subr_cpu_topology.c:140-141` (array `:63`, SYSINIT `:823`) |

## Build
```
cc -O2 -o topo_oob topo_oob.c
```

## Run
```
./topo_oob
```

## Expected (bug present, proven by harness)
```
170      1pkg SMT2  257  OVERFLOW   1
256      1pkg SMT2  386  OVERFLOW   130
RESULT: OOB_CONFIRMED
```
The unbounded cursor at `subr_cpu_topology.c:140-141` overruns
`cpu_topology_nodes[MAXCPU=256]` for topologies needing >256 nodes (threshold
N=170 logical CPUs). On N=256 that is 130 OOB writes (~268 KB of BSS).

## Why not a live runtime test
The trigger is the boot-time CPU topology (CPUID, firmware/hypervisor
controlled). This guest has 6 vCPUs (needs ~14 nodes), so the bug is dormant
here. The harness faithfully reproduces the cursor arithmetic and proves the
OOB deterministically. Not a local-user syscall bug — no `uid=0` chain applies.

## Fix
`fix.diff` bounds the cursor with graceful topology truncation (instead of the
finding's panic). See `VERDICT.md`.