# DF-2440 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
dm_target_delay_table advances p through the DM_MAX_PARAMS_SIZE buffer but passes DM_MAX_PARAMS_SIZE (the FULL size) as the ksnprintf limit at every step (_table() and the space separator), so the remaining-space accounting is wrong once p > params.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Latent OOB-write enabler: with the current field widths (udev_name %d:%d, uint64 offset, int delay, twice) the strings cannot approach 512 bytes, so no overflow is reachable today; the fix makes the bound real. Root-gated dm surface.

## Threat / reachability
Latent buffer accounting bug on a root-gated status path; cannot overflow with current field widths.

## Privilege escalation assessment
n/a (hardening)

## Fix
Pass the remaining space (DM_MAX_PARAMS_SIZE - (p - params)) into _table and the separator ksnprintf.

## Kernel references
- `sys/dev/disk/dm/delay/dm_target_delay.c:189`
- `sys/dev/disk/dm/delay/dm_target_delay.c:197`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

Note: an earlier draft of this fix.diff failed the first combined build (see _batch41/README.md); the shipped diff is the corrected, compile-clean version.