{
 "status": "reproduced",
 "reproduced": 1,
 "impact": "dos",
 "confidence": "certain",
 "verdict": "Signed overflow collapses user-configured delays, fully demonstrated on the real dmsetup path: control 500ms -> 502ms; 21474837ms (5.96h expected) completed in 12ms with dmsetup table showing the internal delay = -2147483 ticks; 42949673ms (11.9h) completed instantly (wrapped to 0 ticks). Fixed-module A/B validated: with the int64 fix the same 21474837ms table reports +2147483 ticks and the write blocks as designed, and normal delays still work.",
 "exploit_chain": "root-configured dm-delay table with a large millisecond value silently disables the delay or shrinks it by orders of magnitude; other values pin bios in the queue for a bogus interval",
 "evidence": "run.log (three timings + kernel-internal table states, baseline and fixed)",
 "kernel_refs": [
  "sys/dev/disk/dm/delay/dm_target_delay.c:140",
  "sys/dev/disk/dm/delay/dm_target_delay.c:142"
 ],
 "poc_changes": "none (real dmsetup + vn backing; fix.diff applied in-guest for the A/B)",
 "attempts": 1,
 "runtime_sec": 600,
 "guest_dirty": 0,
 "build_cmd": "make -C /usr/src/sys/dev/disk/dm/delay (module); fix build: patch -p1 < fix.diff && make",
 "run_cmd": "dmsetup create + delaytime writes (see run.log)",
 "notes": "hz=100 on this guest",
 "recommended_fix": "compute di->delay in int64 (tmp * (int64_t)hz / 1000) and reject values exceeding INT_MAX ticks",
 "finding_id": "DF-2438",
 "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64",
 "runner": "df-bsd-reviewer",
 "code_hash": "0cee9713d321cf53872c5fe6e4f3ba19abaed046995a7a02d721d42562c82ad0"
}