# DF-2835 evidence pack — sys_vmspace_create ABI contract not enforced

File: `sys/vm/vm_vmspace.c:146-201` (contract comment at :134-139)
Severity: Info (CWE-20) — hardening; no memory-safety consequence today

## Contract (sys/vm/vm_vmspace.c:134-139)

    Create a VMSPACE under the control of the caller with the specified id.
    An id of NULL cannot be used.  The type and data fields must currently
    be 0.

The implementation never checked `uap->id`, `uap->type`, `uap->data`.

## Verified on stock kernel (run.log)

| call | documented | observed (stock) |
|---|---|---|
| `[1]` create(id=NULL, 0, NULL) | -1/EINVAL | **rc=0 — ACCEPTED** |
| `[2]` create(id=NULL) again | -1/EINVAL | -1/EEXIST → NULL is a live RB-tree key |
| `[3]` create(id, type=123, data=0xdead0000) | -1/EINVAL | **rc=0 — type/data silently ignored** |
| `[4]` create(id, 0, NULL) | 0 | 0 — legitimate use unaffected |

Run as unprivileged uid 1001 with `vm.vkernel_enable=1`.

## Fixed kernel (run.fixed.log)

`[1]` → -1/EINVAL, `[3]` → -1/EINVAL, `[4]` → 0. Contract enforced,
legitimate call path unchanged.

## Files

- `vmsp_abi.c` — the PoC (exit 0 = bug reproduced, exit 1 = enforced)
- `run.log` / `run.fixed.log` — stock vs patched output
- `fix.diff` — shared with DF-2834 (same patch adds the EINVAL guards)
- `build.log`, `env.txt`, `VERDICT.md`, `manifest.json`, `verdict.json`

## Reproduce

```
build.sh        # cc -O2 -Wall -o /tmp/vmsp_abi vmsp_abi.c
run.sh          # sysctl vm.vkernel_enable=1; /tmp/vmsp_abi as unpriv; restore
```