# DF-2790 — VERDICT

status: reproduced | reproduced: 1 | impact: corruption | confidence: certain

All three claim layers confirmed on the stock guest via the harness (blist(64), count==0): (1) all-free leaf: blist_alloc(bl,0) returns 0 'successfully' and CLEARS the whole 64-bit leaf (mask = ~0>>64 is UB; on x86-64 the mod-64 shift leaves mask=~0); the subsequent alloc(1) returns SWAPBLK_NONE - 64 blocks of capacity silently lost while bl_free still counts them. (2) partially-free leaf: alloc(0) walks j to 64 where the shifted-out mask becomes 0, matches anything, wipes the whole leaf and returns blk+64 - an OUT-OF-RANGE block number; subsequent alloc(1) then hands out block 0 again (double-alloc of freed-but-not-allocated state on the swap blist). (3) blist_create: no BLIST_MAXBLKS guard - while (radix < blocks) with blocks > 2^61 wraps the int64 radix to 0 and loops forever (NOT executed on the guest; arithmetic is exact and the KKASSERT(skip>0) cannot fire before the wrap). On the fix kernel alloc(0) returns SWAPBLK_NONE and alloc(1) succeeds on both leaf states; create gains a domain KKASSERT. In-tree callers pass count in [1,64] and clamped sizes, so latent hardening.

## Baseline vs fix kernel
baseline: baseline: alloc(0)=0 alloc(1)=NONE | fix: alloc(0)=NONE alloc(1)=0 / baseline: alloc(0)=64 (out-of-range) alloc(1)=0 | fix: alloc(0)=NONE alloc(1)=0
fix:      behavior changed as designed (see verdict)