# DF-2656 - Verification Verdict

**Status:** reproduced
**Impact:** none (hardening)
**Confidence:** certain

## Mechanism
The port allocates the deflate state, window, prev, head and pending overlay with plain kmalloc(M_INTWAIT) - upstream zlib zcalloc() uses calloc semantics (ZEROED memory). Output independence therefore rests on runtime invariants rather than allocation guarantees: the port DOES keep the upstream fill_window high_water zeroing (lines 915-938 zmemzero window beyond high_water) and zmemzero(head) at init (line 194), which currently prevent stale-heap bytes from ever being read into the output window/match chain.

## Verdict
source-confirmed (no runtime PoC; deterministic code trace of the cited path:line in the read-only sys/ tree). Code-certain divergence + invariant analysis: with the shipped guards, compressed output is independent of stale heap contents (the subtle invariant holds today); M_ZERO on the six allocations restores upstream calloc semantics as defense-in-depth so a future refactor of the high_water logic cannot turn stale kernel heap into compressed-file bytes. Compile-validated with the batch build.

## Threat / reachability
Defense-in-depth on the hammer2 compression path: any future loss of the high_water zeroing invariant would leak freed kernel memory into compressed file contents.

## Privilege escalation assessment
n/a (hardening)

## Fix
Add M_ZERO to the six kmallocs (matches upstream zcalloc/calloc allocation semantics).

## Kernel references
- `sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:239`
- `sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:254`
- `sys/vfs/hammer2/zlib/hammer2_zlib_deflate.c:915`

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.