# DF-2502 -- Signed int len from u_int32 dxfer_len: sign-extended bzero/kmalloc/bcopy in atapi_action

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: dfv_acam  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
kldload dfv_acam.ko; sysctl kern.dfv_acam_run=0 (control); reset; sysctl kern.dfv_acam_run=2 (hostile)

## Expected
run.log: DF2502 bzero(len=18446744071562067968) hostile vs bzero(len=512) control; fixed: zero bzero calls.

## Fix validation
fix.diff rejects dxfer_len > 0x7fffffff with CAM_REQ_INVALID before any use; A/B shows zero bzero calls.

Verdict: reproduced / impact=corruption (see verdict.json, VERDICT.md)