{
  "finding_id": "DF-2819",
  "title": "kmalloc_obj zone-limit accounting uses cacheline-aligned objsize while callers derive limits from unaligned sizeof: tmpfs inode quota exhausts at ~85% of configured cap",
  "verdict": "reproduced",
  "impact": "none",
  "severity": "Low",
  "confidence": "certain",
  "reproduce": {
    "build": "cc -O2 -o /root/fill /root/fill.c   (plus optional szprobe KLD: cd /root/szprobe && make)",
    "run": "mount -t tmpfs -o size=8g,inodes=1600000 none /mnt/tfill && chmod 777 /mnt/tfill && su -m nobody -c '/mnt/tfill/fill /mnt/tfill 1500000'",
    "expected": "ENOSPC at k=1360369 files (85.02% of the 1,600,000 inode cap; predicted 1,360,000); vmstat -m shows tmpfs_node MemUse == Limit == 415M with tm_nodes_inuse (1.36M) < tm_nodes_max (1.6M)"
  },
  "kernel_refs": [
    "sys/kern/kern_kmalloc.c:899",
    "sys/kern/kern_kmalloc.c:694-708",
    "sys/kern/kern_kmalloc.c:715",
    "sys/kern/kern_slaballoc.c:610",
    "sys/vfs/tmpfs/tmpfs_vfsops.c:206-207",
    "sys/vfs/tmpfs/tmpfs_subr.c:107-113"
  ],
  "artifacts": [
    "README.md", "VERDICT.md", "fill.c", "szprobe.c", "build.sh", "run.sh",
    "run.log", "vmstat.txt", "env.txt", "fix.diff", "manifest.json", "verdict.json"
  ]
}