# DF-2861 — VERDICT

status: reproduced | reproduced: 1 | impact: none | confidence: certain

Mechanically confirmed via the harness on the stock guest: sglist_consume_uio over an unmapped user VA appended the segment {ss_paddr=0x0, len=16} and returned success - _sglist_append_buf never checks pmap_extract() failure (subr_sglist.c:125-156): an invalid user buffer becomes a physical-page-0 DMA segment instead of EFAULT; a consumer would transfer to/from physical page 0. Only reachable via append_user/append_uio/consume_uio which have zero in-tree callers (dead paths; FreeBSD HEAD likewise unchecked). On the fix kernel the same call returns EFAULT with nseg=0.

## Baseline vs fix kernel
baseline: baseline: ret 0 seg paddr=0 | fix: ret 14 EFAULT nseg 0
fix:      behavior changed as designed (see verdict)