# DF-3356 — negative qsize survives set_fs_parms clamping: signed/unsigned compare in dummynet_io never fires -> unbounded queue growth / memory-exhaustion DoS (DF-0376 family in v3)

**File:** sys/net/dummynet3/ip_dummynet3.c (pass 2)
**Severity:** Low (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L) — CWE-195 Signed to Unsigned Conversion Error
**Verdict:** reproduced (dos) on stock INVARIANTS guest, see verdict.json.

## Build
copy `dfv3.c` + `setup.sh` to the guest, then (root):
    cc -O -o /tmp/dfv3 /tmp/dfv3.c

## Run
    sh /tmp/setup.sh      # kldloads ipfw3 (default-accept) + dummynet3, adds queue rules
    /tmp/dfv3 qsize -1 400 (then control: qsize 50 400)

## Expected
GET dump shows len=399 drops=0 with qsize=-1 vs len=50 drops=349 control

`setup.sh` sets `net.filters_default_to_accept=1` BEFORE `kldload ipfw3` —
ipfw3 otherwise boots default-deny and locks out ssh.

## Fix
`fix.diff` (union patch for DF-3352..DF-3356; the hunk for THIS finding is:
clamp negative qsize to the defaults in set_fs_parms (fix.diff hunk 4)).