# DF-0268 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: inflate()/inflate_blocks has no decompression-ratio/iteration cap; a highly-compressed PPP stream drives unbounded CPU (output bytes are caller-bounded via avail_out, CPU is not). DoS posture for ng_ppp deflate.

## Impact ceiling
dos

## Cited refs
- sys/net/zlib.c

## Fix
Documented the missing cap; callers (ng_ppp) must additionally bound compressed input. Comment-only (compiles).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=not_testable.