# DF-2771 — `mapsize` 64-bit wrap in link_elf_obj_load_file → undersized KVA mapping → wild `bzero` past its end

## Build (host)
```
python3 gen_module.py df2771.ko mapsize-wrap
```
(no guest build needed — the trigger is a hand-crafted 554-byte ET_REL object)

## Run (guest, root — kldload is SYSCAP_NOKLD-gated)
```
scp -F dfbsd-qemu/config df2771.ko dfbsd:/tmp/
dfbsd-qemu/vm.sh run_root 'kldload /tmp/df2771.ko'
```

## Expected — stock kernel (baseline, reproduced)
Serial console (see panic.txt):
```
Fatal trap 12: page fault while in kernel mode
fault virtual address = 0xffffffff82602000
fault code = supervisor write data, page not present
Stopped at memset+0xd5: repe stosq
```
The two NOBITS sections declare `sh_size` 0xFFFFFFFFFFFFF000 and 0x2000
(sum ≡ 0x1010 mod 2^64), so the `mapsize` accumulator wraps to 0x1010 → a
2-page mapping is created, then `bzero(mapbase+16, 2^64-0x1000)` (link_elf_obj.c:760)
zero-fills forward until the first unmapped page past the mapping → panic.

## Expected — patched kernel (fix.diff applied, kernel #1 Sep 1 2026)
```
kldload: /tmp/df2771.ko: section too large
```
RC=1, no panic, guest stays up (`ALL-SURVIVED`).

## Threat model
kldload(2) is root-only (`caps_priv_check_self(SYSCAP_NOKLD)`, kern_linker.c:792)
and blocked at securelevel>0 — this is **root-supplied-input / verified-boot
class** (malformed or substituted module), consistent with the Low-severity
calibration of DF-0040/0041/0042.