# DF-0965 — twofish_set_key missing key-length validation

## Summary
`twofish_set_key()` at `sys/crypto/twofish/twofish.c:425` does not validate
its `key_len_bits` argument. For `key_len_bits >= 320` (k_len >= 5) the
function performs out-of-bounds writes on size-4 stack arrays
(`me_key[4]`/`mo_key[4]`), out-of-bounds writes on the struct's `s_key[4]`
(continuing into `mk_tab[4*256]`), and out-of-bounds reads of the caller's
key buffer. The `gen_mk_tab` switch also silently falls through for
unsupported sizes.

**Reachability:** All in-kernel callers (`twofish_cbc_setkey`,
`twofish_xts_setkey` in `sys/crypto/cryptoapi/cryptoapi.c`) validate the
key length against {128,192,256}/{256,512} before calling, and
`cryptoapi_cipher_find()` requires `probe()` to accept the size. So the
bug is NOT reachable through the kernel syscall surface. This is a
defense-in-depth hardening gap.

## Reproduce (function-level harness)
```sh
./build.sh && ./run.sh
```
Expected output (function-level proof, runs as `maxx`):
```
[control] key_len_bits=256 (k_len=4): status=0x0 exited 0, k_len=4 (function OK)
[trigger] key_len_bits=640 (k_len=10): status=0x0 exited 0, k_len=10 (function accepted oversized key)
BUG CONFIRMED: ctx->k_len=10 > supported max(4). ...
```

## Fix-validation (function-level)
```sh
./build_fixed.sh    # applies fix.diff to a copy of twofish.c, rebuilds, runs
```
Expected output (oversized keylen now refused):
```
[control] key_len_bits=256 (k_len=4): status=0x0 exited 0, k_len=4 (function OK)
[trigger] key_len_bits=640 (k_len=10): status=0x0 exited 0, k_len=0 (no bug observed)
```

## Files
- `trigger.c` — function-level harness (compiles real twofish.c)
- `build.sh` / `run.sh` — build + run the harness
- `build_fixed.sh` — applies `fix.diff` to harness source and re-tests
- `fix.diff` — git-apply-able unified diff against `sys/crypto/twofish/twofish.c`
- `build.log` / `run.log` / `fix_run.log` — full untrimmed outputs
- `env.txt` — guest environment
- `VERDICT.md` — detailed analysis
- `manifest.json` — artifact catalog