# DF-3202 — wildCaseCmp() unbounded recursion: stack exhaustion from star-heavy rule names

## Root cause
`wildCaseCmp()` (`sys/vfs/devfs/devfs_core.c:2875`) recurses once per `'*'`
processed — the "less-optimal" branch at :2902-2903:

    for (i = 0; s + i < mary[d]; ++i)
        if (wildCaseCmp(mary, d + 1, w + 1, s + i) == 0) ...

The compiled frame is 80 bytes (objdump: `push %rbp` + 5 regs + `sub $0x18`
+ return address). A `DEVFS_RULE_NAME` rule whose name is a few hundred
`'*'`s therefore recurses a few hundred frames deep inside
`devfs_rule_checkname()` when DEVFS_RULE_APPLY walks the tree — on the devfs
core thread — and exhausts the kernel stack.

## Reproduced (minimal PoC, clean boot)
Rule name = 300 `'*'`s, `DEVFS_RULE_PERM` (checkname runs for NAME rules
regardless of cmd), one DEVFS_RULE_APPLY:

```
Fatal double fault
rip = 0xffffffff8091c316        <- wildCaseCmp+6 : push %r15
panic: double fault
```

Incidental reproductions during this audit: 252-star name (DF-3200 control
pattern) and ~95-star name (DF-3199 offset-100 pattern) — the threshold on
this kernel is between ~60 and ~95 stars.

## Fix
`fix.diff`: reject NAME patterns with more than 32 `'*'`s at rule-add time
(32 x 80 B = 2.5 KB worst case; real devfs.rules patterns use a handful of
wildcards). A full iterative rewrite of the matcher would also work but is
more invasive.

## Files
`star_rec.c`, `build.sh`, `run.sh`, `panic.txt`, `fix.diff`,
`run.fixed.log`, `verdict.json`, `manifest.json`

## Incidental reproductions (earlier in the session)
- 252-star pattern (DF-3200 control rule): first crash of the session
  (boot.log preserved at DF-3201/panic.doublefault.2.txt).
- ~95-star pattern (DF-3199 offset-100 rule): crashed the leak run at the
  same rip.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.