# DF-5190 — vmalloc()/vzalloc()/vmalloc_user() implemented over kmalloc violates the Linux vmalloc contract

## Status

**Info / speculative — no runnable PoC (verification skipped per reviewer contract:
Info-tier hardening finding).** The pack documents the code-trace analysis that
establishes (a) the contract violation, (b) why it is *not* exploitable in this
tree today, and (c) what changes would make it live.

Additionally, this pack carries the pass-2 **negative evidence** for the sibling
candidate "kvmalloc_array divide-by-zero on element size 0"
(`negative-kvmalloc-div0.txt`): empirically refuted on the shipped kernel binary.

## What to look at

* `VERDICT.md` — full analysis
* `negative-kvmalloc-div0.txt` — guest experiment disproving the kvmalloc_array #DE claim
* `fix.diff` — proposed kmem-backed reimplementation of the vmalloc family

Nothing to build or run for the finding itself.