# DF-2921 — INT64 overflow in nvtruncbuf/nvnode_pager_setsize → unkillable kernel livelock

Unprivileged 3-syscall trigger on HAMMER2 that spins a CPU inside the
kernel forever (unkillable), blocks all other access to the file's vnode
(`rm` hangs, `shutdown` hangs — guest only recoverable by killing QEMU).

## Build (in guest)
    ./build.sh            # cc -O2 -o /tmp/op2921 op2921.c

## Run (as unprivileged user, THROWAWAY VM ONLY)
    ./run.sh              # backgrounds the trigger, shows R0/D state after 15s
    # then: kill -9 <pid>  — has no effect on a vulnerable kernel

## Expected on a VULNERABLE kernel
    - op2921 stuck in kernel (state R0), no output past (at most) the
      first two lines; kill -9 ineffective
    - second run on the same file parks in D state
    - `rm /home/maxx/df2921.bin` hangs
      (console: `cache_lock_shared: rm blocked ... "df2921.bin"`)
    - `shutdown -p now` hangs

## Expected on a FIXED kernel (fix.diff applied)
    All four steps of op2921 print OK and the process exits immediately
    (see run.fixed.log).

## Files
    op2921.c              trigger
    livelock-evidence.txt observations + exact overflow math
    fix.diff              fix (sys/kern/vfs_vm.c: clamp + unsigned math)
    run.fixed.log         trigger on patched kernel
    VERDICT.md            full narrative