# DF-2480 verdict -- mmcsd daddr_t (int32) truncation of block addresses past 1 TiB

status: reproduced   reproduced: 1   impact: corruption
confidence: certain   attempts: 1   runtime_sec: 600

The verbatim mmcsd_rw/mmcsd_delete (extracted whole) assign bio->bio_offset/sz into daddr_t (= __int32_t, sys/types.h:80) block/end. Control (1000 sectors): cmd.arg correct. At exactly 1 TiB the arg still bit-matches (0x80000000). At 2 TiB the u64 block 0x100000000 arrives at the card as cmd.arg=0x00000000, and at 4 TiB+12345 sectors as 0x00003039 - the READ/WRITE/ERASE command is issued against the WRONG SECTOR (silent data corruption on >1TiB SDXC/eMMC media, or spurious EIO depending on card). mmcsd_delete shares the math (cited :534). Fix (64-bit locals + reject blocks beyond the 32-bit MMC argument with EIO) A/B: no MMC command is issued for the hostile offsets (opcode/arg unchanged, transfer skipped).

## Evidence (decisive lines)
DF2480[0]: bio_offset=000000000007d000 -> u64 block=1000; cmd.arg=0x000003e8 (CORRECT)
DF2480[2]: bio_offset=0000020000000000 (2048 GiB) -> u64 block=4294967296 (0x100000000); verbatim code sent cmd.arg=0x00000000 (TRUNCATED/WRONG)
DF2480[3]: bio_offset=0000040000607200 -> u64 block=0x200003039; verbatim sent cmd.arg=0x00003039 (TRUNCATED/WRONG)
DF2480[4]: erase path (mmcsd_delete) same math
--- fixed source A/B ---
DF2480[2]: cmd.opcode=0 (NO command issued - bio rejected with EIO)




## Exploit chain / privesc assessment
no attacker needed - media-size correctness bug; corruption affects data at wrong sectors on large cards.

## Fix + A/B
fix.diff switches to u64 block math and rejects beyond-32-bit blocks; A/B shows no wrong-sector command.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.