# DF-2068 PoC — Unchecked capacity*struct_size overflow (latent / defense-in-depth)

## Status: VERIFIED (source-only) + FIX VALIDATED

The overflow pattern is real in three `dal_vector_*` functions
(`vector.c:43`, `:71`, `:293-294`); `kcalloc` is `kzalloc(n*size)` with
no overflow check (`linux/slab.h:44`). Currently latent — the lone
in-tree caller (`dc_link_ddc.c`) bounds `count<=32` with a compile-time
`sizeof`, so no live caller overflows `uint32_t`. Filed as
defense-in-depth.

See `VERDICT.md` for the full source-trace and the validation of
`fix.diff` (which adds `capacity > 0xffffffffu / struct_size` guards).

## Reproduce

```
./build.sh   # rebuilds the patched kernel (rc=0 with -Werror)
./run.sh     # source-only confirmation; no runtime PoC (latent)
```

## Latent primitive

```c
dal_vector_create(ctx, 0x40000000u, 0x10u);
/* capacity*struct_size = 2^30 * 16 = 2^34 wraps to 0 in uint32 */
/* kcalloc allocates ~0 bytes; vector->capacity = 2^30 */
dal_vector_append(vec, &elem);
/* writes 16 bytes past 0-byte slab allocation -> heap corruption */
```