# DF-0955 — PoC

`vm_contig_pg_alloc` calls `vm_contig_pg_free(start, (i-start)*PAGE_SIZE)`
unconditionally on alloc-loop failure. On the first iteration `i==start`
so size=0, which `vm_contig_pg_free` panics on.

## Build

```
./build.sh
```

## Run

```
./run.sh
```

## Expected

The PoC hammers memory pressure hoping to drive an indirect
kernel-internal `contigmalloc` into the verify→alloc race. On this
guest, no `/dev/cpuctl`, `/dev/netmap`, or active DRM, so the direct
trigger paths are absent and the stress test does not panic.
See `VERDICT.md` for the source trace.

The fix (`fix.diff`) is a one-line obvious correctness fix: add
`if (i > start)` before both `vm_contig_pg_free` calls in the alloc
loop.