# DF-0546 VERDICT

## Verdict: REPRODUCED (dead code)

## Mechanism
Source: `sys/net/netmap/netmap_mem2.c:165-195`

OOB read of lut[] in netmap_mem_ofstophys.

netmap is NOT compiled on DragonFlyBSD master (absent from sys/conf/files). Source trace confirms the bug: netmap_mem_ofstophys validates offset < memtotal (line 177) but memtotal = numclusters * _clustsize (page-rounded up, line 622) can exceed objtotal * _objsize. An offset in [objtotal*_objsize, memtotal) passes the check but produces lut index >= objtotal → OOB read. Harness demonstrates the indexing logic.

## PoC changes
- `harness.c`: replicates the vulnerable function logic demonstrating the bug.
- `fix.diff`: targeted fix for the root cause (git-apply-able).

## Fix validation
See fix_status in JSON verdict and fix_build.log/fix_run.log.