# DF-2890 PoC evidence pack

## What
vm_contig_pg_alloc verify/alloc loops lack a v_page_count bound: oversized size reads past the end of vm_page_array.

## Build
```
make (KMOD dfv_safe)
```

## Run
```
kldload dfv_safe.ko; sysctl -w dfv.cg2890=1; dmesg | grep DF2890
```

## Expected
dmesg: OOB READ at idx >= v_page_count executed (4 samples); :331 pre-check PASSES for high=BUS_SPACE_MAXADDR

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64
All logs are full untrimmed captures unless noted. fix.diff is the
git-apply-able verified fix (authored after verification; never applied
to the audit tree).