# DF-5278 — VPD parser cannot terminate on hostile input (dead size check + negative `remain`) → unbounded allocation loop

## What

Two independent termination defects in `pci_read_vpd()`
(`sys/bus/pci/pci.c:1046-1324`):

1. **Dead oversize check (pci.c:1095-1101).** When a long-form item's
   length exceeds the VPD address space, the code sets `state = -1` and
   prints "invalid VPD data" — but then *falls through* into the
   `switch (name)` which unconditionally overwrites `state` (1, 2 or 5).
   The check has no effect; `remain` up to 65535 is accepted.
   Demonstrated by harness mode `t2a`.

2. **Negative `remain` (pci.c:1189 / 1260).** A VPD-R/VPD-W item whose
   declared length is 1 or 2 (smaller than its own 3-byte keyword header)
   drives `remain -= 3` below zero. Every exit transition tests
   `remain == 0`, which can never be true again, so the state machine
   cycles between the keyword-header and keyword-value states **for as
   long as the device serves bytes** — each cycle `kmalloc()`s a value
   buffer and (for non-zero `dflen`) grows the keyword array by doubling
   (`krealloc`). A device that always completes VPD transfers (the
   malicious-device model; also see DF-5276 for the same precondition)
   keeps the parsing thread in an infinite loop with unbounded kernel
   memory growth → permanent thread stall + kernel OOM.

   Additionally, each new VPD-R/VPD-W/String *section header* overwrites
   `cfg->vpd.vpd_ros` / `vpd_w` / `vpd_ident` without freeing the previous
   allocation (pci.c:1109, 1120, 1128) — with the termination bug this is
   an unbounded leak; even standalone it leaks the prior section's array
   and values.

Harness mode `t3` drives the verbatim parser with an endless keyword
stream, capping the *simulated device* at 300,000 bytes — the only thing
that stops the parse. Allocation accounting for the capped run is printed.

## Reproduce

```
cd ../DF-5276 && sh build.sh && ./vpd_harness t2a && ./vpd_harness t3
```

Expected (vulnerable): `t2a` prints "invalid VPD data" and *still*
produces a 1280-byte identifier (parse continued); `t3` shows ~75k
allocations consumed for 300k device bytes with the state machine still
cycling (device cap, not parser logic, ended the run).

Expected (patched): `t2a` aborts with `vpd_ident NULL`; `t3` exits at the
malformed section header with a handful of allocations.

## Fix

`fix.diff` (shared with DF-5276): make the oversize check effective and
abort the item when `remain < 0` after the keyword header.