{
  "finding_id": "DF-2934",
  "title": "m_tag_alloc silently truncates int len/type into uint16_t m_tag_len/m_tag_id",
  "severity": "Info",
  "verdict": "untested",
  "impact": "none",
  "confidence": "certain",
  "reproduce": {
    "build": "n/a — kernel-internal API, no user-reachable length parameter",
    "run": "n/a",
    "expected": "n/a — hardening gap; no in-tree caller exceeds 0xFFFF (21 call sites audited)"
  },
  "kernel_refs": [
    "sys/kern/uipc_mbuf2.c:256-268",
    "sys/sys/mbuf.h:138-143"
  ],
  "artifacts": [
    "README.md",
    "VERDICT.md",
    "verdict.json",
    "manifest.json"
  ]
}