# DF-2478 -- md auto-creation on open is unbounded (kernel memory exhaustion)

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: dfv_md  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
kldload md (built-in); ./md_grow 3; ls /dev/md*; su -m operator_user -c dd if=/dev/md0 ...

## Expected
run.log: /dev/md1 auto-created by opening /dev/md0; operator-group dd: Operation not permitted (EPERM) x3; root dd: 1+0 records in/out.

## Fix validation
fix.diff caps the auto-create branch at mdunits < 256; explicit root creation stays unlimited.

Verdict: reproduced / impact=denial_of_service (see verdict.json, VERDICT.md)