# DF-0134 — l64_readdisklabel lacks structural validation

| | |
|---|---|
| Verdict | **REPRODUCED** |
| Impact | structural-validation gap; out-of-slice label accepted (cross-boundary device access) |
| File | `sys/kern/subr_disklabel64.c:189-195` (read path); contrast set path `:278-304` |

## Build
```
cc -o craft_label craft_label.c
cc -o readback readback.c
cc -o setlabel setlabel.c
```

## Run (as root — "crafted disk" precondition)
```
./run.sh
```

## Expected (bug present)
The read path (`DIOCGDINFO64`) returns the out-of-slice partition unchanged:
```
part[1]: p_boffset=65536  p_bsize=100663296  end=100728832  *** OUT-OF-SLICE (readdisklabel accepted it!) ***
RESULT: LEAK_CONFIRMED
```
and `/dev/vn0s0b` is created and readable. The set path (`DIOCSDINFO64`)
rejects the same label.

## Expected (fixed)
`readdisklabel` rejects the crafted label; `readback` reports
"no disk label" / the device gets no OOB partitions; `RESULT: NO_LEAK`.

## Mechanism (short)
`l64_readdisklabel` checks only magic/npartitions/CRC and copies the label
in-core with no bounds check on partitions, unlike `l64_setdisklabel` which
validates `p_boffset+p_bsize <= d_total_size` etc. A CRC-correct crafted label
with out-of-slice partitions is therefore accepted and the OOB partitions get
real device nodes.

See `VERDICT.md` for the full analysis and `fix.diff` for the patch.