# DF-0924 — PoC: kernel memory exhaustion via large `read()` resid

## Goal

Demonstrate that an unprivileged local user can force the kernel to
`kmalloc` up to ~2 GiB per `read()` call against `/proc/<pid>/map`, by
passing a huge `resid`.

## Build & run

```
cc -o alloc_dos alloc_dos.c
./alloc_dos        # in several terminals in parallel
vmstat -w 1        # observe freemem collapse
```

## Expected output

`vmstat` shows free memory collapsing toward zero; the system becomes
unresponsive; OOM-killer activity may appear; or `procfs_map.c:78` `EIO`
storms appear in `dmesg` when the kernel finally fails the allocation.

On a 2 GiB-RAM VM, expect the panic / hang within seconds.

## Notes

- The kernel `kmalloc` is up-front (sbuf_new with flag 0; see
  `subr_sbuf.c:178-205`).
- The fix is to cap `buflen` at a sane bound (e.g. 1 MiB) regardless of
  the caller's requested read length; `uiomove_frombuf` already handles
  positional truncation, so capping only changes how many syscalls the
  reader issues, not the visible output.