# DF-0202 — umtx kprintf log-flood DoS

## Summary
`sys_umtx_sleep` / `sys_umtx_wakeup` emit a kernel `kprintf("WARNING
can't translate ...")` on every call made on a leaf-PTE-invalid but
page-table-walk-resolvable user address, with no rate limit.  Any
unprivileged user can flood the kernel msgbuf / dmesg / serial console.

## Build / Run
```sh
./build.sh         # cc -O2 -Wall -o umtx_flood umtx_flood.c
./run.sh 2000      # 2000 umtx_sleep calls; observe msgbuf delta
```

## Expected (bug present)
- 2000 calls -> 2000 `umtx_sleep() (A): WARNING can't translate ...`
  lines added to `kern.msgbuf`.
- Larger floods block the serial console (synchronous kprintf) and
  wedge the guest.

## Expected (fixed kernel)
- 2000 calls -> exactly 1 msgbuf line (`ratecheck()` 1/s throttle).

## Files
- `umtx_flood.c` — trigger PoC.
- `fix.diff` — rate-limit via `ratecheck()`.
- `VERDICT.md` — full narrative + reproduction transcript.
- `serial_flood_proof.txt` — guest-wedging serial backlog.