# DF-0249 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: iolen = b_bcount - b_resid (both int) assigned to size_t; a driver bug with b_resid>b_bcount yields a negative int -> huge size_t, copyout reads past b_data (heap disclosure) and underflows iov_len/uio_resid. Defense-in-depth (needs driver accounting error).

## Impact ceiling
leak

## Cited refs
- sys/kern/kern_physio.c:112

## Fix
Clamp iolen to >=0 before use so a bad b_resid cannot drive an oversized copyout.

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.