# VERDICT — DF-2780: p_mqueue_cnt accounting broken across fork → EMFILE bypass

**Status: REPRODUCED** · impact: dos (per-process mqueue limit bypass enabling
unbounded queue creation) · confidence: certain

## What was proven on the guest (stock kernel, build #0)

`./fork_cnt` output (run.log):
- control: fresh process creates exactly **512** queues → EMFILE
  (kern.mqueue.mq_open_max=512);
- open-existing path: `mq_open(existing) at/past EMFILE limit: SUCCEEDED`
  — no limit check exists on this path at all (`sys_mqueue.c:531-563`);
- fork path: child closes ONE inherited descriptor as the last file
  reference (pipe-synchronized after the parent closed its copy) — its
  `u_int p_mqueue_cnt` (`proc.h:235`) underflows 0 → 0xffffffff in
  `mq_close_fop()` (`sys_mqueue.c:384`) — then creates **513** queues before
  hitting EMFILE (the equality check `== mq_open_max` at `sys_mqueue.c:452`
  misses the wrapped counter; 0xffffffff + k wraps past 512). Exit code 42:
  BYPASS REPRODUCED.

## Fix validation (patched kernel, build #1 04:57)

`fix.diff`: (1) kern_fork.c inherits the mqueue count across fork (counts
DTYPE_MQUEUE descriptors after fdcopy); (2) `>=` instead of `==` at both
checks; (3) limit enforced on the open-existing path.

Patched output (fix_validation.log):
- control: unchanged (512/EMFILE);
- existing path: `Too many open files` (was: SUCCEEDED);
- fork path: child creates **512** (was 513), `bypass not observed`,
  exit=1 (was 42).

fix_status: **fixed** (fix_baseline_reproduced=1, fix_patched_reproduced=0).