# DF-5329 VERDICT

## Status: REPRODUCED (the guard provably never fires)

## What was reproduced
`cam_periph_invalidate()` (sys/bus/cam/cam_periph.c:576-577) contains
the CAM core's ONLY underflow detector:

```c
else if (periph->refcount < 0)
        kprintf("cam_invalidate_periph: refcount < 0!!\n");
```

`refcount` is `u_int32_t` (sys/bus/cam/cam_periph.h:123), so the
comparison is always false and the message can never print.

**Guest proof** (evilcd2 rig, cd periph; DF-5273's burn PoC drives the
refcount negative):
```
[poc] round 0 burn 0: ... refcount=-1
[poc] round 0 burn 1: ... refcount=-2
[poc] round 0 burn 2: ... refcount=-3
sysctl debug.evilcd.refcnt -> -5
sysctl debug.evilcd.invalidate=1   # runs cam_periph_invalidate()
dmesg | grep -c "refcount < 0" -> 0
```
With the count at 0xFFFFFFFB, `cam_periph_invalidate()` ran and printed
nothing; the periph became a silent zombie (not freed at 0, not
reported negative, permanently stuck until reboot). Repeated across two
guest sessions.

## Impact
Observability/containment gap only (the underlying underflows are
DF-5273/DF-5327's bugs). It converts a detect-and-warn condition into a
silent integrity failure and removes the only diagnostic that would
have surfaced this bug class in the field. Info severity.

## Fix
`fix.diff`: signed comparison in the guard plus an underflow check (and
loud report, no release) in `cam_periph_release()`'s fast path so a
wrapped count cannot keep sinking. Validated by inspection only (Info
finding; no kernel rebuild spent).

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.