# DF-1981 Verification

## Verdict
**SOURCE-CONFIRMED, INCONCLUSIVE-RUNTIME (module/root gated).**

The cited defect exists in the audited source at `sys/dev/disk/dm/flakey/dm_target_flakey.c:122-135`.
dm flakey target is loaded as part of the dm module and requires root for
dmsetup ioctls (requires /dev/mapper/control write access).

## Mechanism (source-only confirmation)
_init_features (L131) overwrites its argc param (int) with atoi64(*argv++)
which returns uint64_t. Assignment to int truncates; atoi64("2147483648") =
0x80000000 → int = INT_MIN. The guard at L132 "if (argc > 6)" misses
negative values (INT_MIN > 6 is false → bypassed). The while(argc) loop with
negative argc runs indefinitely, doing *argv++ past the end of the argv array
→ OOB read → kernel panic (NULL deref).

## Recommended fix
Store atoi64 result in an int64_t, validate range [0..6] BEFORE truncating
to int, then assign the validated value to argc.

The full `git apply`-able diff lives in `fix.diff` in this folder.