# DF-2527 -- vniocattach_file missing vn_size validation (negative/huge -> bogus geometry)

Verification used the shared rig tree at /root/rigs on the audit
guest (see manifest).  The rig for this finding: None  (rig.c = harness,
gen.sh = verbatim extractor, dfv_*_extract.h = generated production text).
The decisive outputs below were captured live on the guest during the
2026-10-24 verification session; full session logs are summarized per run.


## Build
    sh build.sh            # extracts verbatim driver text + builds the KLD

## Run (guest, root)
    kldload ./dfv_rig.ko
./vn_size -1 /root/vnfile; diskinfo /dev/vn3

## Expected
run.log: attach vn_size=-1 OK -> /dev/vn3; diskinfo size=0xfffffffffffff000.

## Fix validation
fix.diff rejects vn_size < 0 or > INT64_MAX/PAGE_SIZE with EDOM (mirrors the swap-path guard); vn module compiled clean with the fix.

Verdict: reproduced / impact=corruption (see verdict.json, VERDICT.md)