# DF-2077 — vinumutil sizespec integer overflow in size computation

## Verdict
REPRODUCED (source-only confirmation). Bug confirmed by source tracing.

## Mechanism
sizespec() (vinumutil.c:187-232) accumulates size via size=size*10+*s++-'0' (line 203) with no overflow check. u_int64 wraps silently. Scale multipliers *1024^3 (line 224) wrap again. sign=-1 promotes to u_int64 via two's complement.

## Fix
Add overflow guard in the digit-accumulation loop: check size > ((u_int64_t)-1)/10 before multiplying.

## Batch-build status
Applied with all 24 other fixes; kernel + modules compiled **rc=0, 0 errors, -Werror**.