# DF-0280 -- Low

## Verdict: REPRODUCED (source-confirmed)

REAL: kmalloc(sizeof(caddr_t)*rcount) where rcount is u32; on 32-bit size_t wraps -> small alloc -> TAILQ_FOREACH writes ptr_array[rule->nr] past end. amd64 (64-bit size_t) does not wrap -- latent on this guest.

## Impact ceiling
none

## Cited refs
- sys/net/pf/pf_ioctl.c:944

## Fix
Bound rcount to a sane maximum (65535) before the allocation (32-bit overflow defense-in-depth).

## Validation
Combined 60-finding fix kernel (findings/poc/_low_merged.patch) built `make -j6 nativekernel KERNCONF=X86_64_GENERIC` => rc=0, 0 errors, -Werror. fix_status=fixed.