# DF-0535 — Integer underflow in ngc_send path-length math: **FALSE POSITIVE**

**Verdict:** FALSE POSITIVE (not reachable). No fix required.

## Why
`ngc_send` computes `len = sap->sg_len - 2`. The finding claims `sg_len` of 0 or
1 underflows `len` to -2/-1, causing `kmalloc((size_t)-1)` / `bcopy(...,(size_t)-1)`
→ panic.

The sockaddr never arrives at `ngc_send` with `sg_len < 2`. The syscall layer's
`getsockaddr()` (`sys/kern/uipc_syscalls.c:1513`) rejects `len < offsetof(struct
sockaddr, sa_data[0])` (== 2) with **EDOM** at line 1521-1522 **before** the
protocol's `pru_send` runs, and line 1528 forces `sa->sa_len = len` so the user
cannot inject a smaller `sg_len` field. Hence `sap->sg_len - 2 >= 0` always.

## Empirical proof (pristine shipped module, root)
| sg_len | sendmsg result                                   |
|--------|--------------------------------------------------|
| 0      | errno=33 (**EDOM** — getsockaddr rejects)       |
| 1      | errno=33 (**EDOM** — getsockaddr rejects)       |
| 2      | success (len=0; no underflow)                    |
| 3, 4   | errno=2 (ENOENT — normal path lookup)           |

No panic at the values the finding predicts. The guard is at
`sys/kern/uipc_syscalls.c:1521-1522`. No `fix.diff` authored (the underflow is
already prevented upstream).

See `VERDICT.md` for the full trace.