# DF-2067 — PoC evidence pack

**Finding:** Unclamped si_iosize_max on syspd allows oversized bio to stall controller
**Class:** Uncontrolled resource consumption / DoS (CWE-770)  |  **Impact ceiling:** dos  |  **Confidence:** speculative

## Status

SOURCE-CONFIRMED. The defect is verified real by line-by-line tracing of the
audited `sys/` tree, but it is **HW/module-gated**: the audit guest lacks the
required hardware/module (LSI MegaRAID (mfi) controller in syspd mode + a GEOM consumer (vinum/gmirror/swap) or fs issuing >MAXPHYS bios), so it cannot be triggered at runtime
here. See `VERDICT.md` for the full mechanism and citations.

## How to reproduce (on a guest that HAS the hardware)

1. Ensure the gating precondition is met: LSI MegaRAID (mfi) controller in syspd mode + a GEOM consumer (vinum/gmirror/swap) or fs issuing >MAXPHYS bios.
2. Apply `fix.diff` to confirm the cited path changes; before the fix the cited
   code path exhibits the behaviour described in `VERDICT.md`.
3. The original finding markdown describes the runtime trigger.

## Build validation (Phase 8)

`fix.diff` applies cleanly to pristine source. All nine findings' fixes were
built together; see `VERDICT.md` "Phase 8" and `fix_build.log`:

    make -j6 nativekernel KERNCONF=X86_64_GENERIC   # rc=0, -Werror, 0 warnings

## Files

- `VERDICT.md` — full narrative, mechanism, citations, fix-build result
- `fix.diff` — standalone `git apply`-able fix (authored post-verification)
- `fix_build.log` — full combined-fix kernel build output (rc=0, -Werror)
- `env.txt` — guest environment for this verification
- `manifest.json` — machine-readable catalog