# DF-2797 — alist API lacks release-kernel domain validation (count==0 wipes/hangs; blocks>2^29 radix-wrap; full-capacity off-by-one)

## What this pack contains

| artifact | what it is |
|---|---|
| `trigger_domain.c` | standalone trigger compiling the *real* `sys/kern/subr_alist.c` with `-DNDEBUG` (emulates a production kernel where `KKASSERT` is a no-op) |
| `kld_adomain/` | KLD that calls `alist_alloc(own_alist, 0, 0)` in kernel mode (legitimate allocator unit-testing pattern) |
| `panic.txt` | serial-console capture of the resulting stock-kernel (INVARIANTS) panic at `subr_alist.c:250` |
| `run.log` | full standalone trigger output (T1 silent leaf-wipe, T2 infinite loop, T3 create-wrap infinite loop) |
| `fuzz_alist.c`, `fuzz.log` | 4.4M-op differential model-test of *legal* API sequences — CLEAN (negative-result evidence scoping this finding to *invalid* inputs only) |
| `build.sh`, `run.sh` | exact commands |
| `fix.diff` | git-apply-able fix (validated: see VERDICT.md) |

## Build

    cc -O2 -g -DNDEBUG -I <srcroot>/sys -o trigger_domain trigger_domain.c

(`-DNDEBUG` = production-kernel emulation; the in-kernel proof uses `kld_adomain/`.)

## Run

    ./trigger_domain            # T1/T2/T3, ~10s (T2/T3 self-limit via SIGALRM)
    # kernel-mode (root): cd kld_adomain && make && kldload ./adomain.ko

## Expected output (baseline, unfixed)

* T1: `2048 zero-count allocs 'succeeded'; bl_free=65536 (of 65536); 1-block
  alloc now -> NONE (FAILURE)` — every `alist_alloc(bl,0,0)` silently
  "allocates" an entire 32-block leaf (mask `(u32)-1 >> (32-count-…)` UB →
  0xFFFFFFFF at count=0), wiping the whole 256MB-DMA-reserve-equivalent
  bookkeeping while `bl_free` still claims full.
* T2: `HANG REPRODUCED: still spinning after 5s` — `alst_leaf_alloc`'s
  `for (j = 0; j <= n; j += count)` never increments (`j += 0`). In-kernel
  this spins with the caller's lock held (`vm_contig_spin` for
  `vm_contig_alist`) → permanent system hang.
* T3: `HANG REPRODUCED` — `alist_create(3000000000)`: `radix *= 16` wraps
  past `alist_blk_t` (u32) to 0 → infinite loop in the radix computation.
* KLD on stock INVARIANTS kernel: `panic: assertion "count" failed in
  alist_alloc at /usr/src/sys/kern/subr_alist.c:250` (see `panic.txt`) —
  proving the only guard is INVARIANTS-only.

## Fixed behavior (see VERDICT.md)

count==0 → `ALIST_BLOCK_NONE` (T1: 0 wipes, alloc still works; T2/T3 return
instantly, no hang); blocks > 2^29 → `alist_create` returns NULL /
`alist_init` panics with an explicit message; `count == bl_radix` allocatable
on leaf-root alists.