# DF-3151 — mirror_read/mirror_write entry validation gaps (Info, hardening)

`hammer_ioc_mirror_read` never validates `mirror->size` (the write path does at
hammer_mirror.c:348) and neither path validates the caller-supplied
`mirror->count`; the 32-bit bounds arithmetic at hammer_mirror.c:156/214/260/424
can wrap. All consequences stay behind copyin/copyout user-address fault
isolation (same gated caller owns ubuf), so this is hardening, not a kernel
memory-safety bug. See VERDICT.md. No PoC (status: untested).