# DF-2890 - verification verdict

Status: **reproduced** | reproduced: 1 | impact: denial_of_service | confidence: likely

OOB read executed on the live kernel with an instrumented replica of the stock loops. With size = (v_page_count + 64) pages and high = BUS_SPACE_MAXADDR (0xFFFFFFFFFFFFFFFF, cpu/x86_64/include/bus_dma.h:47), the :331 pre-check (phys+size > high) PASSES (phys+size = 0x1e775e000), and the verify loop condition (i < start + size/PAGE_SIZE, vm_contig.c:377) has no v_page_count bound: with a tail candidate (start = v_page_count - 4) the loop read pga[998273]..pga[998276] - four REAL one-past-end reads at 0xfffff80047a04180.. executed (values returned to the harness log); the loop would otherwise run to index 1996606 = 2x the array. Compare-only OOB read of adjacent kernel memory (no disclosure channel); the practical impact is the O(n^2) rewalk plus 3 full page-queue flush passes stalling all contigmalloc callers. No in-tree attacker-reachable oversized caller (cpuctl clamps; DRM/netmap gated) - defense in depth.

## Evidence pointers
run.log DF2890 lines: OOB READ idx=998275/998276 word0=0x0; pre-check PASSES; loop runs to 1996606

## Kernel references
- sys/vm/vm_contig.c:377
- sys/vm/vm_contig.c:331
- sys/vm/vm_contig.c:398

## PoC changes vs the filing sketch
replica harness (function is static); reads limited to 4 past-end elements for safety

## Fix
recommendation: bound both loops by vmstats.v_page_count and reject candidates whose span cannot fit the array

fix status: not_testable

fix compiled in fix-all kernel; replica logic shows fixed loop stops at v_page_count

Guest: DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:04 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.