# DF-2325 — signed left-shift UB in pci_add_map BAR sizing at ln2size 31 — evidence pack

Finding: `sys/bus/pci/pci.c:2644,2650` — `count = 1 << ln2size;` and
`end = base + (1 << ln2size) - 1;` shift a signed `int` literal into
the sign bit at ln2size 31 (2 GiB BAR) — C11 6.5.7p4 UB — and the
sign-extended result poisons the u64 resource range.

## Verdict (short)

REPRODUCED on the stock INVARIANTS kernel through the verbatim
`pci_add_map`/`pci_mapsize`: a fabricated BAR decoding 2 GiB yields
`count=0xffffffff80000000`, `end=0xffffffffbfffffff` (expected
`0x80000000` / `0xbfffffff`); controls at 1 GiB and 64 KiB are
correct; the REAL `resource_list_add` accepts the garbage range into
the device list. Kernel CFLAGS (`-fno-strict-overflow`, no
`-fwrapv`) make the wrap deterministic on this build (cc 8.3).
Impact is a permanently broken BAR reservation for 2 GiB-BAR devices
(correctness/availability; no memory-safety effect). Fix A/B validated:
`1ULL` shifts produce correct values at 31 with lower sizes unchanged.

## Rig

Shared with DF-2323 (same verbatim-interposition kernel-compiled
harness; verbatim sha256 gates; see DF-2323/rig). BAR sizing probe
emulated at the interposed PCIB_WRITE/READ_CONFIG boundary; computed
(start,end,count) captured at the interposed resource_list_add.

## Reproduce

`sh rig/run_2325.sh` — see rig/bar_capture.log (baseline) and
rig/fixed_runs.log (fixed kernel, DFPCIPF).

## Files

* VERDICT.md — narrative + value table + CFLAGS determinism
* rig/bar_capture.log — baseline captures (stock kernel)
* rig/fixed_runs.log — fixed-kernel captures
* rig/cflags_evidence.txt — -fno-strict-overflow, no -fwrapv
* rig/ — shared harness + fix.diff
* env.txt, manifest.json, verdict.json