{
  "finding_id": "DF-2904",
  "status": "untested",
  "reproduced": 0,
  "impact": "none",
  "confidence": "speculative",
  "verdict": "Latent OOB write, not practically reachable: mbr_extended()'s signed int slice counter (subr_diskmbr.c:423, incremented at :492/:498, bound-checked only by 'slice >= MAX_SLICES' at :490) would index dss_slices[] with a negative value after 2^31 accepted EBR entries, letting mbr_setslice write attacker-controlled ds_offset/ds_size before the array. Reaching it requires billions of successful synchronous EBR reads within one probe (depth-capped 4-ary tree, Σ4^i ≈ 5.7G max), i.e. days of the DF-0133 wedge must first be sustained — the system is already catatonic long before the wrap. Not executed on the guest (precondition is a multi-day hammer); documented as speculative with a one-line fix.",
  "exploit_chain": "",
  "evidence": [
    "README.md: full arithmetic (Σ4^i for level<=16 ≈ 5.7G > 2^31) and the wrap path"
  ],
  "kernel_refs": [
    "sys/kern/subr_diskmbr.c:423",
    "sys/kern/subr_diskmbr.c:465",
    "sys/kern/subr_diskmbr.c:490",
    "sys/kern/subr_diskmbr.c:495"
  ],
  "poc_changes": "none — analysis-only finding",
  "attempts": 0,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul  2 06:02:54 UTC 2026     root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC  x86_64",
  "runtime_sec": 0,
  "guest_dirty": 0,
  "build_cmd": "",
  "run_cmd": "",
  "code_hash": "",
  "notes": "Layered on the DF-0133 exponential recursion (known, not re-reported); filed because the bounds guard is type-broken. Fix: unsigned/clamped slice count.",
  "recommended_fix": "Make the slice counter unsigned (or clamp dss_nslices at MAX_SLICES inside the loop) so the >= MAX_SLICES guard cannot be defeated by int wrap"
}