# DF-3182 — tmpfs usermount memory cap is attacker-declared: size_max is never clamped to pages_limit

## What

`tmpfs_mount` computes a system cap
`pages_limit = vm_swap_max + vmstats.v_page_count / 2`
(sys/vfs/tmpfs/tmpfs_vfsops.c:157) but then applies it only to the default
(size_max == 0) case, halved. For any explicit `size_max` the mount takes
the attacker's value verbatim — the `OFF_TO_IDX(size_max) > pages_limit`
branch is deliberately unclamped (comment at :164-169: fstab boot-order
concerns), up to `OFF_TO_IDX(INT64_MAX) = 2^51` pages:

```c
	} else if (OFF_TO_IDX(size_max) > pages_limit) {
		/* do not force pages = pages_limit ... */
		pages = OFF_TO_IDX(size_max);      /* no clamp! */
	} else {
		pages = OFF_TO_IDX(size_max);      /* identical branch */
	}
```

There is no distinction between root mounts (where the fstab rationale may
apply) and non-root usermounts: with `vfs.usermount=1`, any user mounting a
tmpfs on a directory they own sets `tm_pages_max` (and the derived
`tm_nodes_max`) arbitrarily (sys/kern/vfs_syscalls.c:151-155 —
`SYSCAP_NOMOUNT_TMPFS` under `__SYSCAP_NOROOTTEST`, default creds are
unrestricted). The ENOSPC machinery in `tmpfs_reg_resize`
(tmpfs_subr.c:1007-1011) then compares against the attacker's number and
never fires — the only backstop is real machine-wide memory exhaustion.

## Reproduce (observed on the guest, unprivileged user maxx, vfs.usermount=1)

```
# ./umount_demo /home/maxx/dfm1
mounter uid=1001 euid=1001, spoofing ta_root_uid/gid=0, ta_size_max=1TiB
statfs: f_blocks=268435456 (x PAGE_SIZE = 1099511627776 bytes = 1024 GiB), ...
```

The designed cap on this guest (4 GB RAM, 4 GB swap) would be
`(1048576 + 520k)/2` ≈ 784k pages ≈ 3 GiB; the user-mounted tmpfs reports
268,435,456 pages (1 TiB), i.e. 341x past the intended bound. Writing past
3 GiB into such a mount succeeds (no ENOSPC) until the machine exhausts
memory — unprivileged whole-system DoS (swap thrash/OOM), by design of the
missing clamp.

## Fix

For non-root mounters (`cred->cr_uid != 0`), clamp:
`if (pages > pages_limit) pages = pages_limit;` (the boot-order rationale
in the comment concerns root fstab mounts only). Optionally also enforce a
global sum across user-mounted tmpfses.