# DF-2552 — sbuf_extend / sbuf_extendsize int-truncation heap overflow

## Summary

`sbuf_extend()` in `sys/kern/subr_sbuf.c` computes the new buffer size via
`sbuf_extendsize(s->s_size + addlen)`. The sum (`ssize_t + int`) is narrowed
to `int` (the parameter type of `sbuf_extendsize`). When the sum exceeds
`INT_MAX`, the narrowed argument is negative, `sbuf_extendsize` returns 16,
and `sbuf_extend`'s `memcpy` overflows the 16-byte allocation by `s_size - 16`
bytes.

**Status:** The code defect is real and confirmed at the harness level.
The bug is **latent** — `sbuf_bcopyin`/`sbuf_copyin`/`sbuf_uionew` (the only
functions that pass large `addlen` to `sbuf_extend`) have **zero in-tree
callers**, so it is not reachable from unprivileged userspace on the current
kernel. A fix.diff is provided as defense-in-depth and validated on a
single-fix kernel.

## Files

- `arith_proof.c` — userspace arithmetic proof (replicates exact sbuf arithmetic)
- `trigger.c` — userspace trigger for the kernel-module harness
- `sbuftest_mod/sbuftest.c` — kernel module that creates /dev/sbuftest and calls sbuf_bcopyin with crafted length
- `sbuftest_mod/Makefile` — kld module Makefile
- `build.sh` — builds arith_proof and trigger
- `run.sh` — runs arith_proof (non-destructive)
- `fix.diff` — git-apply-able fix (overflow guard in sbuf_extend)
- `VERDICT.md` — full analysis
- `manifest.json` — artifact catalog

## Build

```sh
./build.sh    # builds arith_proof and trigger (userspace, as unprivileged user)
```

## Run

```sh
./run.sh      # runs the arithmetic proof (non-destructive)
```

## Expected output (arithmetic proof)

The proof shows:
- Normal case (sbuf_put_byte path, addlen=1): correct, no overflow.
- Bug case (sbuf_bcopyin path, crafted len): `sbuf_extendsize` returns 16 for a 4096-byte buffer → 4080-byte overflow.
- Fixed version: detects overflow, returns ENOMEM.

## Kernel-module harness (requires root to load)

```sh
# On the guest (as root):
cd /root/sbuftest_mod && make obj && make
cp /usr/obj/root/sbuftest_mod/sbuftest.ko /root/sbuftest.ko
kldload /root/sbuftest.ko

# As unprivileged user:
cd ~/poc/DF-2552 && ./trigger

# Check result (as root):
dmesg | grep SBUFTEST
# Unpatched: "post-overflow s_size=16" (overflow occurred)
# Patched:   "post-overflow s_size=4096" (extend refused, no overflow)
```