# DF-2527 verdict -- vniocattach_file missing vn_size validation (negative/huge -> bogus geometry)

status: reproduced   reproduced: 1   impact: corruption
confidence: certain   attempts: 1   runtime_sec: 200

LIVE reproduction on the stock kernel through the real ioctl path (no rig): a root VNIOCATTACH with vn_size = -1 pages succeeded and diskinfo /dev/vn3 reported size=0xfffffffffffff000 (17179869184.00 GB) - the sign-extended -1*PAGE_SIZE/512 quotient published as the media size (vn.c:559-560 computes vn->sc_size = vio->vn_size * PAGE_SIZE / sc_secsize with only an if(vio->vn_size) guard; the swap path validates <= 0 at :617, the file path does not). d_media_blocks=0xfffffffffffffff8 propagates through the disk layer (diskinfo renders the bogus capacity; d_ncylinders truncates to u_int per the finding). SYSCAP_RESTRICTEDROOT-gated: root-only as filed. Fix (range-check like the swap path) compile-validated in the vn module build; a patched-kernel live A/B was out of scope for this batch (vn is compiled into the stock kernel) - the fix is the same guard the swap path has proven for years.

## Evidence (decisive lines)
attach vn_size=-1 (pages): OK -> /dev/vn3
vn3: covering /root/vnfile on #B255:0x0, inode 96874
/dev/vn3   blksize=512  offset=0x000000000000  size=0xfffffffffffff000 17179869184.00 GB




## Exploit chain / privesc assessment
root-only logic/DoS: bogus capacity published (partitioning/data-corruption surprises); no memory corruption.

## Fix + A/B
fix.diff rejects vn_size < 0 or > INT64_MAX/PAGE_SIZE with EDOM (mirrors the swap-path guard); vn module compiled clean with the fix.


## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.