# DF-2744 VERDICT — disk_dumpcheck() unsigned underflow

**Status: reproduced (the underflow precondition and the exact wrapped
value that feeds the dump bounds check). Impact: dump-time OOB writes on
the dump device; requires root to configure the dump device and a crafted
label64 on it → Low. Confidence: certain.**

- Live (run.log): crafted label64 with d_bbase = 32 GiB inside a 1024-sector
  slice; DIOCGPART on /dev/vn1s1 returned media_blocks=1024,
  reserved_blocks=67,108,864 — the two operands `disk_dumpcheck()`
  (sys/kern/subr_disk.c:909) subtracts. 1024 − 67108864 wraps to
  18,446,744,073,642,443,776, which is the `size` that `diskdump()`
  compares `ap->a_offset + ap->a_length - offset` against
  (subr_disk.c:1288-1296) — the check can never reject. A crash dump
  configured on such a slice writes past the partition end.
- The label path is unvalidated on read: `l64_readdisklabel()` checks only
  magic/npartitions/CRC (sys/kern/subr_disklabel64.c:174-196); `ds_reserved
  = d_bbase / secsize` (subr_disklabel64.c:521-527).
- Not executed to an actual OOB dump write (that would require crashing
  the guest with this slice configured as dumpdev); the arithmetic and its
  inputs are demonstrated exactly.
- Secondary (same function): di.mediaoffset/mediasize are scaled by
  DEV_BSIZE although blkno/size are in media blocks (subr_disk.c:935-936)
  → wrong dump geometry for non-512B sector media.

## Suggested fix
In `disk_dumpcheck()`: reject reserved >= blocks
(`if (pinfo.reserved_blocks >= pinfo.media_blocks) return (EINVAL);`)
and compute offsets/sizes in secsize units; optionally validate d_bbase in
l64_readdisklabel against the slice size.