# DF-3240 VERDICT — REPRODUCED (guard bypass + wild fault-protected read; impact: none)

## What was run
`df3240_buflen_overflow.c` (uid 1001 maxx) on stock kernel #0:
1. plain read of /proc/self/map -> 1416 bytes (sanity);
2. 128 protection-alternating anon mmaps inflate the map (prevents entry
   merging) so the truncated sbuf overflows;
3. `pread(fd, buf, 0x1000, 0x7ffffffffffffff8ULL)`.

## Result (run.log)
```
plain map size = 1416 bytes
pread -> n=-1 errno=14 (Bad address)
done, still alive (kernel did not panic)
```

## Interpretation
- A bounds-respecting kernel returns 0 (EOF) or EINVAL for this pread;
  EFAULT can only come from `uiomove()` faulting on the wild SOURCE
  address `sbuf_data(sb) + 0x7ffffffffffffff8` (heap_kva + 2^63, wrapping
  into the top of user VA, unmapped). `std_copyout`'s PCB_ONFAULT window
  (sys/platform/pc64/x86_64/support.s:228-279) catches the fault -> EFAULT
  instead of a panic.
- Math: buflen = 0x7ffffffffffffff8 + 0x1000 = 0x8000000000000FFE
  (negative ssize_t) passes procfs_map.c:75 (`buflen >= INT_MAX` false);
  sbuf_new int-truncates buflen+1 to 0xFFF (4095-byte buffer); overflow
  path leaves buflen wrapped (sbuf_finish != 0 at procfs_map.c:243);
  uiomove_frombuf (kern_subr.c:272-282) passes the roundtrip offset check
  (0x7fff... < 2^63) and copies from the wild address.
- Impact ceiling: no kernel disclosure (wrapped address is always user
  range: kernel heap >= 0xffff800000000000 minus ~2^63 lands <=
  0x7fff_ffff_ffff_ffff), no panic (onfault), no DoS. Demonstrates the
  guard bypass concretely and that DF-0924's INT_MAX alloc cap is
  bypassable. Severity Low (hardening).

## Fix
Overflow-safe bound check (fix.diff): reject when
`uio_offset > INT_MAX - uio_resid` (both already checked non-negative).
fix_status=not_testable: the observable (EFAULT) is benign; validating
"EFAULT becomes EINVAL" requires a second kernel build which is not
warranted for a Low/hardening finding with impact none.

## Artifacts
- run.log (decisive), build.log, env.txt, fix.diff

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.