# DF-0935 — PoC evidence pack

**Verdict: FALSE POSITIVE** (overflow cannot trigger). See `VERDICT.md` for the
full analysis.

## What the finding claims
`procfs_dorlimit` formats 12 rlimit entries into `char psbuf[512]` using
unbounded `ksprintf`. The finding claims total output can reach 600 bytes and
overflow the buffer by 88.

## What actually happens
- The unbounded `ksprintf` is real, but the data flowing into it is bounded.
- **3 of the 12 rlimits** (`RLIMIT_NOFILE`, `RLIMIT_NPROC`, `RLIMIT_POSIXLOCKS`)
  are clamped by `int`-typed sysctls (`maxfilesperproc`, `maxprocperuid`,
  `maxposixlocksperuid`) inside `kern_setrlimit` (`kern_plimit.c:358-380`).
  `int` caps cannot hold 19-digit values — only 10-digit values (max
  2147483647).
- The finding's "12 × 19-digit = 600 bytes" math wrongly assumes all 12
  resources can hold 19-digit values.
- The real maximum (under the most extreme admin config: every achievable cap
  raised to its absolute max) is **499 bytes — under 512**.

## Files

| File | Purpose |
|------|---------|
| `dfpoc-rlimit-overflow.c` | Original PoC (unchanged). Prints "no overflow". |
| `maxcalc.c` | Computes the exact max output across 3 cap scenarios. All < 512. |
| `maxinflate.c` | Maximally inflates all 12 rlimits as unprivileged user, reads `/proc/self/rlimit`. Confirms 431 bytes on default config. |
| `build.sh` / `run.sh` | Repro scripts. |
| `build.log` / `run.log` | Full untrimmed build/run output. |
| `env.txt` | Guest environment. |
| `VERDICT.md` | Full narrative verdict with `path:line` citations. |
| `fix.diff` | **Defense-in-depth** hardening (ksprintf → ksnprintf), NOT a security fix. |
| `manifest.json` | Machine-readable catalog. |

## Reproduce
```
ssh dfbsd-maxx   # unprivileged user (uid 1001)
cd poc/DF-0935   # after copying this folder to the guest
./build.sh && ./run.sh
```
Expected: `Scenario A (every achievable cap maxed): 499 bytes -> UNDER 512`,
`read 431 bytes`, `OVERFLOW? no`. No panic, no kernel message, guest stays up.

## Fix status
`not_applicable` for the security claim — there is no misbehavior to fix.
`fix.diff` is hardening only (mirrors the bounded `ksnprintf` pattern already
used by the sibling `procfs_dostatus` in `procfs_status.c`). Per procedure,
no Phase 8 kernel build is performed because `status = not_reproduced`.