# DF-4273 — twa(4) passthrough `buffer_length` completely unvalidated at the ioctl boundary

File: `sys/dev/raid/twa/tw_osl_freebsd.c` (pass 2)

## What this pack contains

- `twa_roundup2_overflow.c` — userspace harness that reproduces, with the exact
  kernel macro (`sys/sys/param.h:403`) and exact kernel types
  (`TW_UINT32 buffer_length`, `TW_UINT32 sg_size_factor`), the allocation-vs-copy
  arithmetic of `tw_osli_fw_passthru()` for attacker-chosen `buffer_length`
  values, and probes for `/dev/twa0`.
- `build.sh`, `run.sh` — exact commands (run on the QEMU guest).
- `build.log`, `run.log` — full untrimmed output.
- `env.txt` — guest uname, PCI inventory (no vendor 0x13C1 device), `/dev/twa*`
  absent, busdma tunables.
- `VERDICT.md` — full analysis narrative including the false-positive kill of
  the "roundup2 wrap → undersized buffer" theory.
- `fix.diff` — proposed bound check.
- `manifest.json`, `verdict.json`.

## Reproduce

```
cc -O2 -o twa_roundup2_overflow twa_roundup2_overflow.c
./twa_roundup2_overflow
```

Expected: table showing `kmalloc()` size vs `copyin()/copyout()` length for each
`buffer_length`; values up to `0x7FFFFFFF` (and beyond) are accepted with no
upper bound (`TW_CL_MAX_IO_SIZE`/128KB is never checked before the kernel
allocation), and values in `[0xFFFFFE01, 0xFFFFFFFF]` wrap `roundup2()` to `0`
(the command is silently treated as having no data payload).