# DF-4062

Hardware-gated finding - PoC skipped (no device on audit guest).
Source citations in the pass-2 result block.

Fix: amr_ioctl_buffer_length returns error or clamps for len > 64KB; reject negative int inlen/outlen; cap ap_data_transfer_length; NULL-check the PASS-path kmalloc