# DF-2811 VERDICT — reproduced (panic via sh_size→int truncation)

**Status: reproduced.** Stock guest kernel
`DragonFly 6.5-DEVELOPMENT #0 Thu Jul 2 06:02:54 UTC 2026 X86_64_GENERIC`,
fresh `vm.sh reset with-src` before the run.

## Evidence
```
link_elf_lookup_symbol: missing symbol hash table     (from the earlier localsym run)
panic: kmem_slab_alloc(): kernel_map ran out of space!
cpuid = 1
Trace beginning at frame 0xfffff80118497608
kmem_slab_alloc() at kmem_slab_alloc+0x42b
kmem_slab_alloc() at kmem_slab_alloc+0x42b
_kmalloc() at _kmalloc+0x5be
link_elf_load_file() at link_elf_load_file+0x5cb
linker_load_file.part.3() at linker_load_file.part.3+0x92
linker_load_module() at linker_load_module+0x116
Debugger("panic")
```
(run.log, panic.txt)

The module's SHT_SYMTAB has `sh_size = 0x80000100`. `int symcnt`
(sys/kern/link_elf.c:414, assigned at :610) receives the truncated value
-2147483392; `kmalloc(symcnt, ...)` at :611 sign-extends it to
0xFFFFFFFF80000100 bytes; the oversized path in _kmalloc reaches
kmem_slab_alloc which, unable to satisfy a ~2^63 request and not allowed
to return NULL for this allocation class, panics the kernel.

## Root cause
sys/kern/link_elf.c:610-623 — 64-bit Elf64 section sizes (sh_size) stored
into signed 32-bit ints (declared :414-415) and used as kmalloc() sizes and
vn_rdwr() lengths with no range validation, no resid (short-read) check,
and no M_ZERO on the buffers (:611/:613 use M_WAITOK only). Variants:
- sh_size > INT_MAX with bit 31 set → negative → this panic;
- sh_size ≥ 2^32 → modulo truncation → under-sized/zero-sized allocation
  silently accepted as a valid symbol table;
- truncated file → short read accepted (resid ignored) → stale heap parsed
  as Elf_Sym/strings by the ddb lookup paths (:846-:858, :899-:913).

Distinct from DF-0057 (e_shentsize) / DF-0058 (sh_link) which concern the
shdr array itself; this is the *sh_size consumption* sink.

## Impact
Root-gated (kldload) crafted-module kernel panic (DoS). Low per the
root-supplied rubric (cf. DF-2772's sh_info panic, Low).

## Fix validation
fix.diff rejects sh_size > INT_MAX for both symtab and strtab before the
kmallocs (and bounds symstrindex, validates e_shentsize, so the
e_shnum*e_shentsize int product can no longer overflow either). Patched
kernel: `kldload: Symbol table too large`, RC=1, guest stays up. See
run_fix.log.