# DF-2478 verdict -- md auto-creation on open is unbounded (kernel memory exhaustion)

status: reproduced   reproduced: 1   impact: denial_of_service
confidence: certain   attempts: 1   runtime_sec: 300

Mechanism reproduced live on the stock kernel: opening the highest md unit auto-creates the next one (opening /dev/md0 produced /dev/md1 with a fresh md_s, devstat entry and cdev; mdopen md.c:135-136 fires whenever sc->unit+1 == mdunits and nothing caps mdunits anywhere in md.c). IMPORTANT threat-model correction, same gate as DF-2504: raw disk opens require SYSCAP_RESTRICTEDROOT (sys/kern/subr_disk.c:1070-1073) - a member of group operator gets EPERM opening /dev/md0 (demonstrated live, three attempts), so the filed unprivileged-operator exhaustion arm is REFUTED on current master; only root (or a RESTRICTEDROOT principal) can drive the growth, and root can already create units without limit by design (mdconfig). Effective severity: Low, privileged. Fix (cap auto-create at 256 units) compile-validated in the md module build.

## Evidence (decisive lines)
before: /dev/md0 only
after ./md_grow (opens md0): /dev/md0 /dev/md0s0 /dev/md1 /dev/md1s0   <- auto-created
operator-group user (testuser, groups=wheel,operator):
  dd: /dev/md0: Operation not permitted   (x3)  <- RESTRICTEDROOT gate
root: dd if=/dev/md1 ...: 1+0 records in, 1+0 records out




## Exploit chain / privesc assessment
no unpriv path (RESTRICTEDROOT gate demonstrated); privileged resource-exhaustion only.

## Fix + A/B
fix.diff caps the auto-create branch at mdunits < 256; explicit root creation stays unlimited.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.