# DF-4984 — dm_target_snapshot.c is unbuildable, unregistered dead scratch code — latent memory-safety bug catalog

**File:** `sys/dev/disk/dm/snapshot/dm_target_snapshot.c` (364 LOC)
**Severity:** Info (dead code — zero attack surface today) · **Confidence:** certain
**Pass 2 (GLM 5.3)** · dmirror precedent: DF-4973
**Verdict:** `untested` (Info hardening/dead-code catalog — no guest PoC required; dead-code
proof is structural and host-side, see VERDICT.md)

## Why it is dead (three independent proofs)

1. **Not in any build.** `sys/dev/disk/dm/Makefile` SUBDIR = `linear striped crypt delay flakey`;
   `sys/conf/files:48-60` lists the dm core + those five targets — no `snapshot/` entry.
   The directory `sys/dev/disk/dm/snapshot/` contains **only** the .c file — no Makefile, so it
   cannot even be built as a kmod by hand without adding files.
2. **Zero references.** No file in `sys/` references `dm_target_snapshot_init`,
   `dm_target_snapshot_orig_init`, or any other symbol from this file (grep over the whole tree).
3. **No self-registration.** Live targets register via `dm_target_alloc("linear")` +
   `dm_target_insert(dmt)` (linear: `dm_target_linear.c:176,186`; flakey: `:411,421`). This file
   contains **no** `dm_target_alloc`/`dm_target_insert`/module machinery at all — even if
   compiled and kldloaded it would register nothing.

**Additionally non-compiling:** line 319 calls bare `snprintf()`, which does not exist in the
DFly kernel (only `ksnprintf`, `sys/sys/systm.h:222`; no `#define snprintf` anywhere in `sys/`).
It is the only dm file using it → undefined symbol at link, exactly the dmirror DF-4973 class.

## Latent bug catalog (must be fixed if the file is ever revived)

Reachability if the file were wired in: any member of group `operator` or root
(`/dev/mapper/control` is `UID_ROOT, GID_OPERATOR, 0640`, `device-mapper.c:181`; no
`priv_check` in the ioctl path — the established DF-1959 threat model).

| # | Shape | Where | Consequence |
|---|-------|-------|-------------|
| L1 | No `argc` validation in `_init`; argv slots beyond argc are **NULL** (`dm_ioctl.c:824` kmalloc M_ZERO) | `:125/:136/:140/:143` | `strcmp(argv[2],"p")` / `atoi64(argv[3])` (`device-mapper.c:584` derefs `*s`) / `dm_pdev_insert(NULL)` (`KKASSERT` `dm_pdev.c:121`) → NULL-deref panic on short table line |
| L2 | Non-persistent snapshot passes `dmp_cow == NULL` to `dm_table_add_deps` | `:146,:149` → `KKASSERT(pdev)` `dm_table.c:277` | Panic at table load for `"n"` flag — **masks L3** |
| L3 | `dm_target_snapshot_table` kprintf derefs `tsc->tsc_cow_dev->name` unconditionally; `name` is at offset 0 (`dm.h:114`) so NULL+0 | `:192-194` | NULL-deref panic on `dmsetup table` of a non-persistent snapshot (doubly unreachable: L2 fires first) |
| L4 | Error path returns without freeing `tsc` and without dropping the `dmp_snap` pdev reference | `:140-141` | kmem leak + permanent pdev/vnode pin per failed load (live-twin: DF-4922 on flakey) |
| L5 | **Cross-allocator free:** `dm_target_snapshot_orig_table` returns a `kmem_alloc(..., VM_SUBSYS_DM, ...)` pointer while the core frees it with `kfree(params, M_DM)` | `:313` vs `dm_ioctl.c:993` | Freeing a kmem-slab pointer through the malloc zone → heap corruption (latent memcorrupt) |
| L6 | **Double-unbusy:** `dm_target_snapshot_orig_destroy` calls `dm_target_unbusy(table_en->target)` while the core *also* unbussies every target in `dm_table_destroy` | `:359` vs `dm_table.c:157` | refcount underflow → `KKASSERT(target->ref_cnt > 0)` (`dm_target.c:58`) panic on next unbusy |
| L7 | Strategy handlers are EIO stubs | `:205-217`, `:325-337` | The target was never functional — mid-implementation scratch |

## Recommended fix

Delete the directory (dmirror precedent, DF-4973), or complete the target (argc validation,
persistent-only cow deps, dm_alloc_string for both table functions, drop the extra unbusy,
error-path cleanup) before ever wiring it into `SUBDIR`/`conf/files`.

## Reproduce (dead-code proof, host-side)

```sh
grep -rn snapshot sys/dev/disk/dm/Makefile sys/conf/files          # nothing
ls sys/dev/disk/dm/snapshot/                                       # only the .c file
grep -rn dm_target_snapshot_init sys/ --include=*.c                # only the defining file
grep -rn "define snprintf" sys/sys/ sys/kern/                      # nothing -> :319 cannot link
```