# DF-5329 evidence pack — `cam_periph_invalidate()` underflow guard is dead code (`u_int32_t refcount < 0` is always false)

## Finding (one line)
`cam_periph_invalidate()` (sys/bus/cam/cam_periph.c:576-577) is the **only**
place the CAM core notices a periph refcount underflow, and its check
`else if (periph->refcount < 0)` can never be true because
`struct cam_periph.refcount` is `u_int32_t` (sys/bus/cam/cam_periph.h:123).
Every underflow of the class proven by DF-5273 / DF-5327 therefore sails
through silently as 0xFFFFFFxx: no warning, no assert — and the periph
becomes permanently unfreeable (zombie) or freeable at a wrapped-wrong
moment.

## Reproduce (guest, root; evilcd2 kld loaded)
```
cd /root/df5327
cc -O -o poc_ref poc_ref.c          # DF-5273 burn PoC (shared rig)
timeout 45 usched :1 ./poc_ref /dev/cd1
sysctl -n debug.evilcd.refcnt       # observe negative refcount
sysctl -n debug.evilcd.invalidate=1 # run cam_periph_invalidate() on it
dmesg | grep -c "refcount < 0"      # expect 0 (guard never fires)
```

## Expected (vulnerable kernel)
```
[poc] round 0 burn 0: ioctl rc=-1 errno=4(Interrupted system call)  refcount=-1
[poc] round 0 burn 1: ioctl rc=-1 errno=4(Interrupted system call)  refcount=-2
[poc] round 0 burn 2: ioctl rc=-1 errno=4(Interrupted system call)  refcount=-3
...
sysctl refcnt -> -5
dmesg grep "refcount < 0" -> 0      <-- guard dead while rc < 0
```

Observed on guest (see poc_ref.out): refcount driven to -5 across runs,
`cam_periph_invalidate()` invoked (debug.evilcd.invalidate) with the count
negative, **zero** occurrences of the "cam_invalidate_periph: refcount < 0!!"
message. The only observability hook for this corruption class provably
never fires on the running kernel.