# DF-2513 -- Unvalidated device-controlled shift in nvme namespace block-size

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: dfv_nvme  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
kldload dfv_nvme.ko; for s in 9 31 36 63; do sysctl kern.dfv_nvme_run=$s >/dev/null; sysctl -n kern.dfv_nvme_status; done

## Expected
run.log: blksize 512/2147483648/16/2147483648 for sect_size 9/31/36/63; fixed: attach skipped.

## Fix validation
fix.diff rejects sect_size outside 9..12 and skips the attach; A/B shows no namespace published.

Verdict: reproduced / impact=corruption (see verdict.json, VERDICT.md)