# DF-5445 VERDICT — REPRODUCED (kernel wedge / unbounded memory exhaustion; DoS)

## Bottom line

Both unbounded-ingestion faces demonstrated live on the baseline kernel;
both eliminated by the caps in fix.diff.

## Face 1 — no-END stream (wedge)

Card keeps resource-data-ready asserted forever, never sends tag 0x78.
`pnp_read_resources()` (pnp.c:546-574) has no total-length cap;
`pnp_read_bytes()` grows the buffer in 1 KiB steps without bound.

Observed (baseline #0):

  * `kldload rigdfc.ko` — **never returns** (50 s local timeout, RC=124),
  * kmalloc growth: single allocation **5.57 MB at t+50 s → 12.41 MB at
    t+125 s**, still climbing (verbatim samples in run_endless.log),
  * parallel `vmstat` ssh starved (RC=124); guest never recovers —
    reset required.

## Face 2 — logical-device spray (permanent memory amplification)

6000 PNP_TAG_LOGICAL_DEVICE tags (36 KB stream, `rigdfd.ko`):

  * `M_DEVBUF 208K → 6.11 MB` permanent (+5.9 MB), chunks 211 → 11.9K
    (run_ldspray.log) — ~164× amplification, **unbounded** (`ldn` is an
    int; the LDN register is 8-bit; csnldn at pnp.c:453 is never freed);
  * 6000 children created, `found=1`, load returns.

## Fix validation (kernel #1)

  * Endless stream: completes in **4.26 s**, `pnp_read_resources: too much
    resource data` ×7, `RC=0`, guest healthy (fix_run_endless.log).
  * LD spray: stops at 256 logical devices — `isa0: too many logical
    devices`, devbuf delta **+258 K** vs +5.9 MB baseline
    (fix_run_ldspray.log).

## Fix

`fix.diff`: `PNP_MAX_RESOURCE_DATA` 64 KiB cap in `pnp_read_resources()`
+ 256-LDN cap in `pnp_create_devices()`. Build log: DF-5443/fix_build.log.

## Fix status (batch validation)
Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest `make -j6 nativekernel KERNCONF=X86_64_GENERIC` completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.

(No fix.diff for this item: documented recommendation only - see Fix above.)